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Preface 


events  of  September  11,  2001,  raised  the  nation’s  awareness  of  the  threat  of  terrorist 
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(CBO)  paper,  prepared  at  the  request  of  the  Ranking  Member  of  the  House  Select  Committee 
on  Homeland  Security,  examines  the  role  of  the  private  sector  in  responding  to  the  threat  of 
terrorism  in  the  United  States  since  September  1 1.  In  keeping  with  CBO’s  mandate  to  pro¬ 
vide  objective,  impartial  analysis,  the  paper  makes  no  recommendations. 
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Summary 


events  of  September  1 1 ,  200 1 ,  raised  the  na¬ 
tion’s  awareness  of  the  potential  scale  of  terrorist  attacks, 
the  likelihood  of  such  attacks,  and  the  benefits  of  spend¬ 
ing  on  homeland  security.  Since  that  date,  the  public  sec¬ 
tor  has  undertaken  efforts  to  boost  security  against  terror¬ 
ism.  At  the  same  time,  there  have  been  calls  for  new  laws 
or  regulations  that  would  require  businesses  to  assume  an 
increased  role  in  the  nation’s  defense  against  terrorists. 
Those  calls  rest  on  the  premise  that  the  social  benefits 
from  private  spending  to  enhance  security  are  greater 
than  the  private  benefits  to  the  businesses  making  those 
spending  decisions.  If  not,  then  businesses  already  have 
incentives  to  do  as  much  as  the  nation  would  find  cost- 
effective  to  enhance  homeland  security. 

This  paper  examines  issues  surrounding  enhanced  secu¬ 
rity  efforts  by  private  industry.  For  several  important  in¬ 
dustries,  it  describes  the  vulnerabilities  and  potential 
losses — to  both  the  private  sector  and  the  nation  as  a 
whole — that  would  underlie  the  expected  costs  of  terror¬ 
ist  attacks  and,  hence,  the  broader  benefits  of  security. 
The  paper  also  reviews  the  incentives  for  private  actions 
to  limit  vulnerabilities  and  losses  for  those  industries  and 
the  existing  government  programs  that  address  those  in¬ 
centives. 

Although  September  1 1  stands  out  as  a  unique  event  in 
U.S.  history,  many  situations  exist  in  which  the  social 
benefits  from  private  actions  to  “take  care”  exceed  the  pri¬ 
vate  benefits  of  such  activities.  In  fact,  existing  regulatory 
requirements  for  the  industries  examined  here  provide  in¬ 
centives — and  in  some  case,  clear  directives — for  private 
parties  to  take  care.  Many  of  those  requirements  were  ini¬ 
tiated  to  meet  policy  goals  for  public  safety  and  environ¬ 
mental  protection.  The  overall  effect  of  current  programs 
constitutes  a  “baseline”  of  incentives  and  institutions  for 
protecting  the  nation,  against  which  any  new  efforts  can 
be  assessed.  Finally,  the  paper  lists  ideas  in  three  broad 
groups  for  new  approaches  that  might  prompt  industries 
to  do  more  to  enhance  security:  those  that  would  cause 
businesses  to  internalize  more  of  the  social  costs  of  terror¬ 


ist  attacks;  those  that  would  have  the  government  assume 
more  of  the  direct  responsibility  for  actions  to  reduce  vul¬ 
nerabilities  and  losses  from  attacks  on  industry;  and  those 
that  would  improve  information  that  might  facilitate  pri¬ 
vate  actions. 

In  the  more  than  three  years  since  the  September  1 1 
attacks,  lawmakers  have  enacted  legislation  affecting 
homeland  security.  They  have  created  the  Department  of 
Homeland  Security  and  federalized  aviation  security.  To 
support  the  Congress’s  consideration  of  homeland  secu¬ 
rity  policy,  this  paper  presents  ideas  that  could  improve 
security  in  several  key  industries.  The  evaluation  is  neces¬ 
sarily  incomplete  because  agencies  and  the  Congress  both 
are  engaged  in  ongoing  processes  to  evaluate  threats  and 
develop  options  to  address  them.  The  analysis  is  also  at  a 
general  level  and  does  not  address  policy  specifics  or 
costs. 

Industries  Analyzed 

This  paper  focuses  on  those  industries  for  which  the  ex¬ 
pected  human  and  economic  losses  from  a  terrorist  attack 
would  be  highest — the  country’s  “critical  infrastructure.” 
The  analysis  more  narrowly  focuses  on  those  industries 
that  reside  largely  in  the  private  sector  and  for  which  an 
attack  could  lead  to  a  direct  loss  of  life.  The  four  activities 
reviewed  here,  selected  from  a  longer  list  of  critical  indus¬ 
tries  identified  by  the  Department  of  Homeland  Security 
and  chosen  because  attacks  on  them  could  be  an  immedi¬ 
ate  threat  to  lives  and  health,  are: 

■  Civilian  nuclear  power, 

■  Chemicals  and  hazardous  materials  (including  oil  and 
natural  gas), 

■  Electricity  service,  and 

■  Food  and  agriculture. 
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Civilian  Nuclear  Power 

Nuclear  power  plants  and  the  nuclear  materials  that  are 
being  processed  or  transported  or  have  accumulated  as  ra¬ 
dioactive  wastes  may  be  subject  to  attacks.  Safety  inci¬ 
dents  at  U.S.  nuclear  plants  and  attacks  by  terrorists 
abroad  have  illustrated  the  potential  to  harm  people  and 
have  long-lasting  effects  on  the  environment.  Two  broad 
classes  of  attack  that  are  of  special  concern  are  direct  at¬ 
tacks  (or  sabotage)  on  either  nuclear  power  reactors  or  the 
large  amounts  of  spent  fuel  stored  at  nuclear  plants. 

The  human,  environmental,  and  economic  costs  from  a 
successful  attack  on  the  nuclear  power  industry  could  far 
exceed  the  value  of  the  nuclear  plants  themselves.  In  the 
most  significant  incident  in  the  United  States  to  date — 
the  partial  meltdown  that  occurred  at  Three  Mile  Island 
in  Pennsylvania — private  economic  losses  have  totaled 
more  than  $2  billion.  (That  sum  includes  the  loss  of  the 
nuclear  facility,  costs  of  decontamination  at  the  site,  costs 
for  decommissioning  the  destroyed  plant,  costs  associated 
with  initial  evacuation  of  neighbors,  and  ongoing  costs 
for  monitoring  the  health  of  local  residents.) 

Assessments  of  the  actual  vulnerability  of  and  potential 
losses  to  the  nuclear  power  industry  vary  widely,  with 
some  industry  experts  believing  that  little  danger  exists. 
However,  even  according  to  studies  in  which  the  proba¬ 
bility  of  an  extreme  accident  has  been  postulated  to  be 
very  remote,  the  losses  from  such  as  accident  could  be  se¬ 
vere.  For  example,  a  study  by  Sandia  National  Laborato¬ 
ries  indicated  that  in  an  extreme  scenario — with  full  re¬ 
lease  of  nuclear  materials,  worst-case  atmospheric 
conditions,  and  no  emergency  response — there  could  be 
very  high  losses  associated  with  reactors  near  population 
centers.  For  a  reactor  near  Limerick,  Pennsylvania,  just 
outside  Philadelphia,  the  study  estimated  75,000  fatali¬ 
ties  within  a  year  of  the  accident,  700,000  injuries,  and 
about  $200  billion  in  costs.  Concerning  releases  from 
spent  nuclear  fuel,  a  study  by  Brookhaven  National  Labo¬ 
ratory  estimated  that  a  severe  accident  involving  only  that 
waste  could  cause  up  to  20,000  cancer  fatalities  and 
nearly  $60  billion  in  damages.  In  contrast,  the  Nuclear 
Regulatory  Commission  said  the  laboratory’s  estimate 
overstates  the  scope  of  radiation  release  that  is  reasonable 
to  consider,  even  in  a  worst  case.  Such  differences  in  loss 
and  probability  assessments  highlight  the  fact  that  esti¬ 
mates  are  fraught  with  uncertainty  even  when  prepared 
for  accidental  occurrences,  not  terrorist-instigated  events. 


The  Nuclear  Regulatory  Commission  has  principal  au¬ 
thority  for  regulating  civilian  nuclear  power  for  public 
safety.  That  regulation  covers  nuclear  fuels,  nuclear  reac¬ 
tors,  and  spent  fuels.  Regarding  the  latter,  the  Depart¬ 
ment  of  Energy  (DOE)  has  primary  responsibility  for  the 
planning  and  construction  of  a  permanent  disposal  facil¬ 
ity  for  high-level  radioactive  wastes  at  Yucca  Mountain, 
Nevada — funded  in  large  part  from  fees  paid  by  nuclear 
power  producers.  In  addition,  other  federal  programs  act 
to  promote  nuclear  power.  They  include  the  indemnity 
program  under  the  Price -Anderson  Act,  through  which 
the  government  addresses  the  negative  financial  impact 
on  industry  from  uncertainty  about  nuclear  accidents, 
and  DOE  programs  that  fund  research  and  development 
of  nuclear  technologies. 

Chemicals  and  Hazardous  Materials 

The  security  of  the  chemical  industry  is  important  prima¬ 
rily  because  of  the  dangers  that  flammable  and  toxic 
chemicals  pose  for  release  into  the  air  or  water  or  for  im¬ 
mediate  explosion  and  fire.  Attacks  could  be  launched  on 
facilities  handling  such  chemicals  or  the  vehicles  that  rou¬ 
tinely  transport  chemicals  through  densely  populated  ar¬ 
eas.  Alternatively,  the  chemicals  themselves  could  be  used 
as  a  weapon.  Although  an  individual  business  and  per¬ 
haps  a  local  economy  would  be  harmed  by  an  attack,  the 
national  economy  would  be  largely  unaffected  because 
many  alternative  sources  exist  for  almost  every  chemi¬ 
cal — including  inventories,  other  suppliers,  and  substi¬ 
tute  chemicals. 

Flammable  petrochemicals  (including  fuels,  solvents,  and 
the  raw  materials  to  make  plastics)  are  concentrated  at  a 
relatively  few  large  production  facilities.  Another  flamma¬ 
ble  substance,  nitrate  fertilizer,  is  available  from  thou¬ 
sands  of  agricultural  distributors  across  the  country  and 
can  form  the  key  ingredient  of  explosive  devices.  How¬ 
ever,  because  the  areas  affected  by  the  explosion  or  burn¬ 
ing  of  flammable  substances  are  generally  limited  to  the 
immediate  site,  relatively  few  people  are  expected  to  be 
affected  by  those  types  of  incidents,  even  in  a  worst  case. 

In  contrast,  small  volumes  of  highly  toxic  substances  re¬ 
leased  into  the  air  or  water  could  spread  farther  and  affect 
larger  populations.  Those  substances  include  ammonia 
and  chlorine,  which  are  used  in  refrigeration,  municipal 
water  purification,  and  many  commercial  applications. 
Each  would  be  poisonous  if  released  in  industrial  concen¬ 
tration.  The  great  majority  of  facilities  and  vessels  that 
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hold  ammonia  and  chlorine  are  small  and  would  put  rela¬ 
tively  few  people  at  risk. 

Federal,  state,  and  local  programs  already  exist  to  require 
or  encourage  the  operators  of  chemical  facilities  and  the 
transporters  and  holders  of  dangerous  chemicals  to  boost 
their  efforts  to  promote  safety  and  security  and  to  share 
information  that  can  help  local  governments  plan  for 
emergencies.  Much  of  the  state  and  local  effort  is  oriented 
toward  emergency  preparedness.  The  federal  effort  in¬ 
cludes  worker-safety,  environmental,  and  information 
programs.  Key  federal  legislation  related  to  the  safety  of 
chemical  facilities  includes  the  Emergency  Planning  and 
Community  Right-to-Know  Act  of  1986  (EPCRA)  and 
the  Clean  Air  Act  Amendments  of  1990  (CAAA).  The 
EPCRA  requires  operators  of  chemical  facilities  to  pre¬ 
pare  contingency  plans  for  possible  accidents,  provide  in¬ 
formation  to  local  planners  on  the  chemicals  they  handle, 
and  notify  local  officials  of  any  sudden  release.  The 
CAAA  mandates  a  role  for  the  Environmental  Protection 
Agency  in  overseeing  risk-management  planning  by  facil¬ 
ities  that  handle  threshold  volumes  of  certain  hazardous 
chemicals  identified  in  the  act  and  by  the  agency. 
(Thresholds  for  toxic  substances  are  based  on  toxicity  and 
volatility,  while  thresholds  for  flammable  substances  are 
based  on  the  potential  for  a  vapor-cloud  explosion.) 

Electricity  Service 

The  vulnerabilities  that  the  nation’s  electricity  supply 
faces  from  terrorism  are  similar  to  those  that  the  electric¬ 
ity  industry  confronts  from  extreme  weather  and  other 
natural  events,  accidents,  and  equipment  failures.  A  ter¬ 
rorist  event  could  disable  major  physical  components  of 
the  supply  network  or  disrupt  the  performance  of  the 
network’s  control  centers.  The  potential  losses  from  such 
disruptions  would  be  limited  and  of  relatively  short  dura¬ 
tion  because  the  industry  and  electricity  customers  are 
generally  well  prepared  for  such  failures.  Concerns  about 
terrorist  attacks  may  give  additional  support  to  proposals 
that  have  been  discussed  to  improve  the  reliability  of 
power  supplies,  including  several  related  to  the  competi¬ 
tive  restructuring  of  power  markets. 

The  major  vulnerabilities  of  electricity  supplies  probably 
are  associated  most  with  regional  transmission  systems — 
the  power  grids  that  carry  electricity  at  high  voltage  from 
power  sources  to  communities.  Experiences  with  major 
outages  involving  regional  grids  suggest  ways  that  a  tar¬ 
geted  attack  could  lead  to  widespread  loss,  although  still 
for  only  short  periods.  Outages  that  could  be  longer  last¬ 


ing  would  be  those  resulting  from  attacks  on  high-voltage 
transformers,  which  are  difficult  to  replace  quickly. 

The  costs  of  an  attack  on  the  nation’s  power  supply  are 
likely  to  be  small.  The  electricity  industry  is  generally 
well  prepared  to  prevent  and  mitigate  disruptions  attrib¬ 
utable  to  many  types  of  system  failures — regardless  of  the 
cause — so  the  scale  and  duration  of  a  disruption  would 
be  limited.  The  prospect  of  disruptions  resulting  from  the 
simultaneous  loss  of  several  high-voltage  transformers 
could  raise  the  costs  of  an  attack  on  a  targeted  commu¬ 
nity.  However,  even  in  that  event,  the  flexibility  of  elec¬ 
tricity  consumers  and  the  economy  in  general  to  adapt  to 
power  losses  would  help  limit  the  costs  of  any  disruptions 
that  did  occur. 

Apprehensions  about  terrorism  are  part  of  the  industry’s 
more  general  concern  about  providing  a  reliable  supply. 
Investments  and  operational  practices  intended  to  make 
electricity  service  reliable  are  recognized  costs  covered  in 
the  regulated  rates  that  utilities  charge  their  customers. 
Many  groups  are  involved  in  ensuring  a  reliable  supply. 
Historically,  the  industry  has  been  structured  and  regu¬ 
lated  as  regional,  vertically  integrated  monopolies,  with 
state  public  utility  commissions  overseeing  local  opera¬ 
tions  and  approving  rates  for  retail  sales  and  the  Federal 
Electric  Regulatory  Commission  overseeing  interstate 
transmission  and  rates  for  wholesale  trade.  For  those  util¬ 
ities,  regulators  approve  investments  that  reflect  the  social 
and  private  costs  of  service  interruptions — generally  pro¬ 
viding  for  sufficient  excess  capacity  to  overcome  the  loss 
of  at  least  one  important  component  at  a  time.  The 
North  American  Electric  Reliability  Council,  an  industry 
group,  also  establishes  voluntary  standards  as  part  of  its 
mission  to  oversee  a  reliable  wholesale  electricity  supply 
in  North  America. 

Food  and  Agriculture 

The  food  and  agriculture  industry  faces  vulnerability  to 
attack  because  of  the  great  number  of  products  at  risk  and 
the  many  unsecured  points  of  access  in  production,  stor¬ 
age,  and  distribution.  In  addition  to  posing  threats  to 
health  and  public  safety,  disruptions  could  cause  eco¬ 
nomic  harm. 

The  food  and  agriculture  industry  is  vulnerable  to  four 
basic  types  of  assaults:  contamination  of  food  with  natu¬ 
ral  agents  (such  as  botulism  and  E.  coli  bacteria),  contam¬ 
ination  of  food  with  man-made  contaminants  (such  as 
poisons  and  foreign  objects),  attacks  to  disrupt  food  sup- 
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plies  (including  the  use  of  fires,  floods,  or  biological 
agents  such  as  foot-and-mouth  disease  and  insects),  and 
use  of  agricultural  resources  as  weapons  for  attacks  on 
other  targets  (such  as  wildfires  that  spread  to  residential 
areas,  nitrate  fertilizer  for  use  in  explosives,  pesticides  for 
poisoning,  crop  dusters  to  spread  toxins,  or  radioactive 
materials  used  in  food  irradiation). 

Many  systems  are  in  place  to  ensure  the  safety  of  food 
supplies  and  thus  reduce  the  vulnerability  to  a  terrorist 
act  involving  food  and  agriculture  as  well  as  limit  any  re¬ 
sulting  losses.  However,  risks  remain  from  attacks  involv¬ 
ing  substances  that  the  government  does  not  regularly  test 
for  and  that  may  not  be  readily  identified  by  government 
agencies  and  public  health  officials.  The  number  of  pub¬ 
licly  documented  crimes  that  have  been  perpetrated  with 
the  intent  of  harming  people  or  disrupting  supplies  is 
small.  At  the  same  time,  those  few  known  assaults  and  a 
number  of  incidents  involving  the  unintentional  contam¬ 
ination  of  food  confirm  the  potential  threats  of  terrorism 
to  public  health. 

The  nation’s  economic  costs  from  a  disruption  of  particu¬ 
lar  food  supplies  would  probably  be  small,  primarily  be¬ 
cause  the  food  and  agriculture  industry  is  well  adapted  to 
the  prospect  of  disruptions  from  weather,  pests,  and  occa¬ 
sional  health  incidents. 

The  regulation  of  the  food  and  agriculture  industry  in¬ 
volves  a  number  of  organizations  within  four  different 
federal  agencies:  the  Department  of  Health  and  Human 
Services  (HHS),  the  Department  of  Agriculture,  the  De¬ 
partment  of  Commerce,  and  the  Environmental  Protec¬ 
tion  Agency.  In  the  food  safety  system,  HHS’s  Food  and 
Drug  Administration  has  perhaps  the  biggest  responsibil¬ 
ity,  regulating  about  80  percent  of  the  nation’s  food  sup¬ 
plies  to  protect  consumers  against  impure,  unsafe,  and 
fraudulently  labeled  foods.  The  nation’s  public  health  sys¬ 
tem,  including  the  Public  Health  Service  and  the  Centers 
for  Disease  Control  and  Prevention,  is  organized  to  help 
identify,  contain,  and  treat  food-related  attacks.  Existing 
government  programs  also  sustain  the  income  of  agricul¬ 
tural  producers. 

The  Private  Sector’s  Role  in  Homeland 
Security — A  General  Framework 

Markets  provide  a  variety  of  incentives  to  producers,  their 
customers,  and  local  communities  to  guard  against  a  wide 
range  of  risks,  including  the  possibility  of  terrorism.  Pri¬ 


vate  producers  of  goods  and  services  generally  will  benefit 
from  safe  operating  practices  (including  physical  security) 
and  the  purchase  of  insurance  to  help  limit  any  financial 
losses.  But  the  incentives  for  private  businesses  to  reduce 
their  vulnerability  to  attack,  and  the  potential  losses  for 
those  who  would  be  affected,  may  be  inadequate  when 
the  private  costs  of  the  threat  of  terrorism  are  lower  than 
the  social  costs  (or,  equivalently,  when  the  private  benefits 
from  security  measures  are  less  than  the  social  benefits). 

Private  costs  would  be  closely  associated  with  damages  to 
production  and  distribution  facilities  and  the  harm  to  in¬ 
dustry  workers,  as  well  as  the  potential  loss  of  business. 
But  the  total  social  costs  could  go  further  and  include  the 
harm  or  loss  of  life  to  individuals  (such  as  the  neighbors 
of  a  targeted  facility  or  the  consumers  of  a  tainted  prod¬ 
uct),  damage  to  the  local  environment,  and  negative  ef¬ 
fects  on  other  businesses  dependent  on  the  targeted  in¬ 
dustry.  If  the  product  of  the  targeted  industry  became  a 
potential  weapon  in  attacks  elsewhere,  the  social  costs 
could  be  broader  still.  For  example,  stolen  chemicals 
could  be  used  to  attack  an  office  building.  If  the  disparity 
between  private  costs  and  social  costs  is  significant,  the 
result  is  that  private  firms  have  insufficient  incentive  to 
meet  social  objectives. 

Many  of  the  government  programs  that  existed  before 
September  1 1  are  intended  to  bring  private  and  social 
costs  into  line.  Many  firms,  especially  those  in  the  four 
critical  industries  studied  here,  had  long  been  subject  to 
extensive  government  intervention  because  of  the  dangers 
that  those  industries’  operations  or  products  can  pose  to 
public  safety,  environmental  quality,  and  local  economies. 

Existing  government  programs  provide  a  starting  point 
for  examining  possible  new  efforts.  Those  programs  may 
be  adequate  to  prompt  businesses  to  address  much  or  all 
of  the  increased  terrorist  threat.  But  if  private  efforts  are 
inadequate,  policy  options  for  prompting  additional  ef¬ 
forts  will  probably  build  on  the  incentives  generated  by 
existing  requirements.  Cost-effective  policies  for  enhanc¬ 
ing  homeland  security  may  involve  expanding  some  pro¬ 
grams  that  have  nonsecurity  goals  while  reducing  others. 
For  example,  programs  that  were  intended  primarily  to 
help  protect  the  public  from  relatively  common  threats, 
such  as  industrial  accidents  or  food  contamination,  could 
be  expanded  to  help  address  the  terrorist  threat.  But  pro¬ 
grams  that  were  intended  to  disseminate  information  on 
critical  industries,  such  as  the  production  and  storage  ca- 
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pacities  of  hazardous  facilities,  might  need  to  be  curtailed 
to  keep  that  information  out  of  the  hands  of  terrorists. 

This  paper  generally  groups  government  intervention  to 
align  the  private  and  social  costs  of  business  decisions 
about  security  into  three  broad  areas: 

■  Programs  that  would  internalize  the  costs  of  security 
to  private  markets  by  establishing  new  standards  or  in¬ 
centives  to  make  businesses  and  customers  in  an  in¬ 
dustry  face  the  full  costs  of  possible  losses. 

■  Programs  that  would  socialize  the  costs  of  security  by 
having  the  government  and  taxpayers  directly  bear  the 
costs  of  reducing  losses,  whether  through  the  govern¬ 
ment’s  own  efforts  or  its  financing  of  efforts  by  busi¬ 
nesses  and  customers. 

■  Programs  that  would  provide  the  private  sector  with 
information  on  the  risk  of  attacks,  the  losses  from  at¬ 
tack,  and  opportunities  to  reduce  losses. 

If  a  chemical  production  facility  was  subject  to  an  attack, 
for  example,  the  ensuing  fire  or  explosion  could  expose 
the  surrounding  community  to  dangerous  toxins.  That 
added  exposure  would  represent  a  social  cost  that  the  pri¬ 
vate  firm  would  not  face — especially  if  the  damage  ex¬ 
ceeded  the  limits  of  the  owner’s  insurance  coverage  and 
other  financial  resources.  As  a  result,  the  owner  would 
have  less  incentive  than  otherwise  to  guard  against  such 
attacks,  scale  back  operations,  or  relocate.  Current  gov¬ 
ernment  programs  affecting  the  safety  of  chemical-plant 
operations  and  supporting  local  emergency  preparations 
are  a  response  to  that  social  cost  and  also  contribute  to 
homeland  security.  However,  the  increased  awareness  of 
the  terrorist  threat  since  September  1 1 — if  not  the  threat 
itself — also  may  indicate  a  need  to  step  up  security  efforts 
since  the  social  benefits  of  spending  on  security  have  in¬ 
creased. 

The  type  of  intervention  that  would  force  industry  to  in¬ 
ternalize  the  costs  of  security  (and  for  which  it  would  bear 
the  immediate  costs)  would  include  requirements  to  take 
preventive  measures,  assessment  of  penalties  for  failing  to 
take  certain  actions,  or  imposition  of  taxes  on  certain  ac¬ 
tivities  or  products. 

The  type  of  intervention  that  would  have  the  government 
socialize  the  cost — so  that  everyone  paid  for  the  enhanced 


security — would  include  new  programs  that  rewarded  in¬ 
dustry  for  taking  measures  to  protect  vulnerable  facilities 
or  make  those  facilities  less  dangerous  (for  example,  by 
supporting  the  adoption  of  safer  production  processes  or 
the  use  of  safer  chemicals). 

Alternatively,  rather  than  force  or  pay  industry  to  make 
certain  changes,  new  programs  could  help  inform  nearby 
residents  of  the  dangers  of  an  attack  or  inform  industry  of 
currently  available  options  for  reducing  its  vulnerabilities. 

Strategies  to  Enhance 
Homeland  Security 

The  broad  strategies  described  in  this  paper  are  not  policy 
recommendations,  nor  do  they  delineate  policies  in  any 
detail.  Many  of  the  ideas  build  on  programs  now  in  place 
for  one  industry  that  may  be  applicable  to  another  indus¬ 
try  or,  where  several  industries  already  are  subject  to  simi¬ 
lar  requirements,  that  may  help  identify  effective  alterna¬ 
tive  approaches.  Some  of  the  ideas  are  currently  being 
considered  by  the  Congress  or  have  been  proposed  else¬ 
where. 

For  nuclear  power  and  chemicals,  some  common  themes 
emerge.  Among  new  approaches  that  would  internalize 
more  of  the  costs  of  terrorist  attacks  within  an  industry 
are: 

■  Establishing  fees  or  taxes  on  sales  of  the  industry’s 
product  or  service  to  discourage  its  use  (in  cases  in 
which  less  production  would  mean  lower  potential 
losses); 

■  Establishing  new  regulations  for  tracking  the  owner¬ 
ship  of  hazardous  chemicals  that  could  be  used  as 
weapons; 

■  Establishing  new,  more  stringent  regulations  that 
would  require  safe  production  practices  (for  example, 
increasing  monitoring  for  toxic  chemical  releases  or 
limiting  volumes  of  the  spent  nuclear  material  stored 
near  reactors); 

■  Creating  financial  disincentives  for  businesses  or  resi¬ 
dents  to  locate  in  danger  zones  (for  example,  by  re¬ 
quiring  higher  insurance  coverage  or  limiting  other 
available  business  tax  incentives); 
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■  Establishing  enhanced  incentives  and  protection  for 
reporting  unsafe  practices,  conflicts  with  best-technol¬ 
ogy  safety  practices,  or  other  sources  of  vulnerability 
and  potential  losses;  and 

■  Requiring  additional  insurance  coverage. 

Alternatively  or  in  combination,  new  approaches  for  the 
nuclear  and  chemical  industries  could  socialize  the  costs 
of  security — placing  the  direct  costs  of  enhancing  security 
on  taxpayers.  If  the  federal  government  has  a  strong  cost 
advantage  over  the  private  sector  in  performing  certain 
security  activities,  federalizing  those  activities  may  be 
cost-effective.  New  initiatives  could  include: 

■  Establishing  positive  fiscal  incentives  for  businesses  to 
adopt  safer  designs  or  production  processes; 

■  Providing  financial  assistance  to  people  and  businesses 
to  move  away  from  potentially  hazardous  sites;  and 

■  Federalizing  and  expanding  the  current  level  of  perim¬ 
eter  security,  structural  defenses,  and  employee 
screening. 

Businesses  and  neighboring  communities  may  underesti¬ 
mate  the  likelihood  of  a  terrorist  attack  and  thus  mis- 
gauge  the  risks  and  costs  of  such  an  incident.  Some  ideas 
for  new  approaches  related  to  nuclear  power  and  chemi¬ 
cals  that  could  help  improve  information  include: 

■  Preparing  vulnerability  assessments  and  potential 
damage  assessments  that  better  reflect  the  worst-case 
scenarios  for  terrorist  attacks  (rather  than  accident 
scenarios); 


■  Making  additional  information  available  to  govern¬ 
ments  on  the  vulnerability  of  certain  facilities  and 
products,  both  to  aid  in  emergency  planning  and  to 
encourage  businesses  to  reduce  those  vulnerabilities; 

■  Establishing  emergency  planning  zones  that  better  re¬ 
flect  current  information  on  estimates  of  losses  and  ac¬ 
count  for  more-complex  worst-case  failures  (for 
example,  involving  multiple  systems  or  attacks  on 
multiple  industries);  and 

■  Establishing  a  national  zoning  system  (for  chemical 
plants  and  nuclear  plants)  to  help  inform  property 
owners  of  their  risks. 

Potential  strategies  for  electricity  service  include  prepar¬ 
ing  for  the  threat  of  attack  on  critical  equipment  that 
might  require  significant  time  to  replace  (such  as  high- 
voltage  transformers)  and  supporting  reforms  that  would 
make  the  electricity  supply  more  reliable  in  the  event  of  a 
disruption.  Providing  more  information  on  alternative 
supplies  of  electricity  could  enable  consumers  to  reduce 
their  dependence  on  single,  vulnerable  suppliers. 

For  the  food  and  agriculture  industry,  initiatives  that 
would  help  internalize  the  costs  of  attacks  within  the  in¬ 
dustry  could  include  requirements  for  enhanced  product 
labeling  and  tracking  (to  help  identify  and  contain  a  po¬ 
tential  contamination)  and  changes  in  the  product  speci¬ 
fications  or  tracking  requirements  for  dangerous  agricul¬ 
tural  supplies  (in  particular,  nitrate  fertilizers  and 
pesticides  that  can  be  used  as  weapons).  Some  of  those 
costs  might  be  borne  by  the  public  if  the  government  in¬ 
creased  its  inspection  of  food  supplies. 
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Introduction 


events  of  September  11,  2001,  and  subsequent 
revelations  of  terrorist  plans  raised  the  nation’s  awareness 
of  the  potential  scale  of  terrorist  attacks,  the  likelihood  of 
such  attacks,  and,  as  a  result,  the  potential  losses  from  ter¬ 
rorism.  Federal,  state,  and  local  governments  as  well  as 
the  private  sector  may  contribute  to  security  efforts  to 
help  reduce  the  chances  of  attack  and  the  losses  from  an 
attack  at  the  lowest  overall  cost  to  the  economy.  The  pri¬ 
vate  sector  generates  the  vast  majority  of  the  nation’s  eco¬ 
nomic  output,  and  there  are  corresponding  incentives 
and  opportunities  for  businesses  to  undertake  security 
measures.  Nevertheless,  the  few  data  that  are  available 
suggest  that  since  September  1 1 ,  relatively  little  addi¬ 
tional  spending  has  come  from  the  private  sector.  ^ 

There  have  been  calls  for  new  laws  or  regulations  that 
would  require  businesses  to  take  an  increased  role  in  the 
nation’s  defense  against  terrorists,  an  approach  that  as¬ 
sumes  it  would  be  cost-effective  for  the  private  sector  to 
enhance  homeland  security.  This  paper  reviews  the  vul¬ 
nerabilities  and  potential  losses  for  several  key  industries 
and  the  current  market  and  government  incentives  and 
institutions  for  undertaking  security  efforts.  The  paper 
describes  a  broad  range  of  policy  approaches  for  each  in¬ 
dustry  that  could  enhance  the  existing,  or  “baseline,”  in¬ 
centives  for  security.  The  baseline  consists  of  current  pro¬ 
grams,  laws,  and  regulations  that  affect  the  likelihood  of 
attack,  the  potential  damage  from  attack,  and  the  re- 


1 .  For  example,  see  the  Conference  Board,  Corporate  Security  Man¬ 
agement:  Organization  and  Spending  Since  9/ II  (New  York:  Con¬ 
ference  Board,  July  2003);  Council  on  Competitiveness,  Creating 
Opportunity  Out  of  Adversity:  Proceedings  of  the  National  Sympo¬ 
sium  on  Competitiveness  and  Security  (Washington,  D.C.:  Council 
on  Competitiveness,  December  2002);  Council  of  Insurance 
Agents  &  Brokers,  “Many  Commercial  Interests  Are  Not  Buying 
Terrorism  Insurance,  New  CIAB  Survey  Shows”  (press  release, 
Washington,  D.C.,  March  24,  2004);  and  Bart  Hobijn,  “What 
Will  Homeland  Security  Cost?”  Economic  Policy  Review,  Federal 
Reserve  Bank  of  New  York  (November  2002). 


spouse  to  (and  ultimate  cost  of)  an  attack.  The  options 
for  new  initiatives  are  not  policy  recommendations,  nor 
do  they  delineate  policies  in  any  detail. 

What  Is  Homeland  Security? 

Homeland  security  has  been  described  as  a  “concerted  na¬ 
tional  effort  to  prevent  terrorist  attacks  within  the  United 
States,  reduce  America’s  vulnerability  to  terrorism,  and 
minimize  the  damage  and  recover  from  attacks  that  do 
occur.”^  At  a  basic  level,  enhancing  security  means  reduc¬ 
ing  the  potential  losses  from  terrorist  attacks  and  the  risk 
of  such  attacks.  “Terrorism”  means  criminal  acts  by  indi¬ 
viduals  or  groups  (whether  of  domestic  or  foreign  origin) 
motivated  by  political  or  social  agendas.  Statutory  defini¬ 
tions  of  terrorism  refer  to  criminal  acts  that  are  dangerous 
to  human  life  and  appear  to  be  intended  to  intimidate  or 
coerce  a  civilian  population,  influence  the  policy  of  a  gov¬ 
ernment  by  intimidation  or  coercion,  or  affect  the  con¬ 
duct  of  a  government.^  In  common  usage  (and  in  this  pa¬ 
per),  terrorism  also  includes  acts  that  may  be  designed  to 
harm  property  and,  more  broadly,  economic  infrastruc¬ 
ture,  with  the  intent  of  furthering  some  political  or  social 
objective. 

From  a  public  policy  perspective,  attacks  by  similar 
means  may  be  associated  with  national  security  threats 
(perpetrated  by  foreign  governments)  and  criminal 
threats  (perpetrated  by  individuals  for  their  personal 
gain).  And  similar  damages  may  occur  from  natural 
events,  technological  failures,  or  human  error.  As  a  result, 
homeland  security  activities  are  closely  related  to  ongoing 


2.  Office  of  Homeland  Security  (predecessor  to  the  Department  of 
Homeland  Security),  The  National  Strategy  for  Homeland  Security 
duly  2002),  p.  2. 

3.  The  basic  legal  definitions  of  international  and  domestic  terrorism 
appear  in  18  U.S.C.  2331. 
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activities  by  businesses  and  governments  to  promote  gen¬ 
eral  safety. 

Viewed  from  the  perspective  of  existing  policies,  busi¬ 
nesses  already  may  be  doing  as  much  as  is  in  the  national 
interest  to  enhance  homeland  security,  given  that  the 
lowest-cost  options  may  be  dominated  by  the  public  sec¬ 
tor.  However,  private  incentives  for  security  that  were  ad¬ 
equate  before  September  1 1  may  now  be  considered  in¬ 
sufficient.  If  so,  new  government  interventions  to 
enhance  private  security  efforts  may  be  appropriate. 

A  Focus  of  Security  Concerns: 

Critical  Industries 

Critical  industries  are  those  in  which  the  expected  human 
and  economic  losses  from  a  terrorist  attack  would  be 
highest.  Expected  losses  reflect  both  the  probability  of  at¬ 
tack  (as  jointly  determined  by  the  attractiveness  of  a  tar¬ 
get  and  its  vulnerability)  and  the  amount  of  damage  that 
could  occur.  Losses  may  be  associated  with  the  incidental 
damage  and  loss  of  life  that  result  from  the  destruction  of 
facilities  or  the  diversion  of  hazardous  materials  to  attacks 
elsewhere,  with  the  direct  harm  from  contamination  of 
products,  or  with  the  indirect  harm  from  the  loss  of  prod¬ 
ucts  or  services.  The  risk  of  such  attacks  may  also  entail 
losses,  including  direct  emotional  trauma  and  economic 
losses  because  employees  or  customers  want  to  avoid  the 
industry. 

Of  immediate  concern  in  protecting  homeland  security 
are  the  physical  assets  that  could  be  attacked  (including 
factories,  buildings,  transmission  lines,  and  the  like)  and 
the  less-tangible  assets  (such  as  networks  for  moving 
goods,  energy,  or  information)  that  could  be  threatened. 
People  could  be  harmed  from  a  disruption  of  emergency 
services  during  a  power  outage  as  well  as  in  a  direct  as¬ 
sault  on  a  factory.  The  nation  has  adopted  the  term  “crit¬ 
ical  infrastructure”  to  describe  such  targets  (see  Box  1-1 
for  more  details  about  the  concept  of  critical  infrastruc¬ 
ture). 

The  Department  of  Homeland  Security  has  identified  a 
number  of  critical  industries  with  “infrastructures  so  vital 
that  their  incapacitation  or  destruction  would  have  a  de¬ 
bilitating  impact  on  defense  or  economic  security.”^ 
Those  critical-infrastructure  sectors  are  agriculture,  food, 
water,  public  health,  emergency  services,  government,  de¬ 


fense,  information  and  telecommunications,  energy, 
transportation,  banking  and  finance,  chemicals,  and 
postal  and  shipping  services.^ 

This  paper  focuses  on  four  of  those  critical-infrastructure 
industries  that  reside  largely  in  the  private  sector.  Those 
industries  are: 

■  Civilian  nuclear  power, 

■  Chemicals  and  hazardous  materials  (including  oil  and 
natural  gas), 

■  Electricity  service,  and 

■  Food  and  agriculture. 

Why  the  Private  Sector  Might  Spend 
Too  Little  on  Security 

Businesses  would  be  inclined  to  spend  less  on  security 
than  might  be  appropriate  for  the  nation  as  a  whole  if 
they  faced  losses  from  an  attack  that  would  be  less  than 
the  overall  losses  for  society.  A  number  of  common  cir¬ 
cumstances  can  exist  in  private  industry  in  which  there  is 
a  gap  between  the  private  and  public  costs  of  a  terrorism 
event. 

Private  costs  for  businesses  or  individuals  could  include 
spending  for  defensive  measures  to  lower  their  vulnerabil¬ 
ity  to  attack,  changes  in  location  or  operations  to  reduce 
their  losses  from  an  actual  attack,  or  emergency-response 
capabilities  to  help  contain  those  losses.  Businesses  could 
also  reduce  exposure  to  some  types  of  losses  by  scaling 
back  operations.  But  when  terrorists  target  a  business, 
they  put  others  at  risk,  too.  Those  other  businesses  and 
individuals  may  not  be  in  a  position  to  undertake  their 
own  security  efforts — for  example,  they  may  not  know 
about  the  threat.  And  in  some  cases,  they  may  not  be  able 
to  hold  the  targeted  business  liable  for  the  damages  that 
they  incur.  The  social  costs  of  terrorism  would  be  the 
sum  of  those  costs  incurred  by  others  and  the  private 
costs  incurred  by  the  targeted  business. 


4.  Executive  Order  13010,  “Critical  Infrastructure  Protection,”  Fed¬ 
eral  Register,  vol.  61,  no.  138  (July  17,  1996),  p. 

5.  Office  of  Homeland  Security,  The  National  Strategy  for  Homeland 
Security. 
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Box  1-1. 

Changing  Concepts  of  Critical  Infrastructure 


In  an  executive  order  authorizing  federal  agencies  to 
adopt  protective  measures,  President  Clinton  defined 
critical  infrastructures  as  those  that  are  “so  vital  that 
their  incapacity  or  destruction  would  have  a  debili¬ 
tating  impact  on  the  defense  or  economic  security  of 
the  United  States.”^  The  concept  of  critical  infra¬ 
structure  and  critical  assets  has  broadened  in  the  past 
few  years  to  go  beyond  concerns  just  about  defense 
and  economic  security.  The  PATRIOT  Act  of  2002 
refers  to  those  “systems  and  assets,  whether  physical 
or  virtual,  so  vital  to  the  United  States  that  [their  in¬ 
capacitation]  .  .  .  would  have  a  debilitating  impact 
on  security,  national  economic  security,  national 
public  health  or  safety,  or  any  combination  of  those 
matters.”  ^ 


1 .  Executive  Order  13010,  “Critical  Infrastructure  Protection,” 
Federal  Register,  vol.  61,  no.  138  (July  17,  1996),  p.  '57?i4:7, 
available  at  www.ntia.doc.gov/osmhome/cip/eol3010.pdf. 


A  related  concept  is  that  of  a  target  industry.  Some 
critical  industries  may  be  the  target  of  attack,  with 
the  losses  at  stake  closely  associated  with  production 
and  distribution  in  those  industries.  In  the  case  of 
other  critical  industries,  their  products  may  be  more 
akin  to  weapons  used  to  carry  out  attacks  elsewhere 
(such  as  highly  flammable  chemicals  used  to  make 
explosives).  Still  other  industries  may  be  critical  to 
homeland  security  because  their  products  are  part  of 
the  solution  to  terrorism — in  particular,  the  finance 
and  telecommunications  industries,  which  can  con¬ 
tribute  to  efforts  to  stem  flows  of  money  or  commu¬ 
nication  among  terrorist  groups. 


2.  Further  discussion  of  the  concept  of  critical  infrastructure 
appears  in  Office  of  Homeland  Security,  The  National  Strat- 
egy  for  Homeland  Security  (July  2002) . 


Incomplete  information  about  the  nature  of  the  vulnera¬ 
bilities,  the  potential  losses,  or  the  costs  of  options  for  en¬ 
hancing  security  can  lead  to  too  little  private  spending  on 
security,  especially  when  all  of  the  affected  players  do  not 
have  access  to  the  same  information.  For  example,  a  busi¬ 
ness  may  know  about  its  exposure  to  attack,  but  the  firm’s 
customers  or  the  surrounding  community  (and  local 
emergency  planners)  may  not.  Or  the  government  may 
have  knowledge  of  threats,  losses,  or  solutions  that  private 
businesses  do  not  have.  (In  some  cases,  there  may  be  an 
argument  for  withholding  available  information  on  vul¬ 
nerabilities  or  losses  if  that  disclosure  would  increase  the 
attractiveness  of  a  particular  target  to  terrorists.  That  pos¬ 
sibility  should  be  weighed  in  considering  policy  opera¬ 
tions  to  improve  private  incentives  for  spending  on 
security.) 

The  term  “moral  hazard”  describes  the  reluctance  of  busi¬ 
nesses  or  individuals  to  undertake  protective  measures 
that  are  otherwise  in  their  interest  because  they  believe 
that  someone  else  will  pay  the  bill  for  any  damages  that 
are  incurred.  Insurance  companies  try  to  avoid  that  prob¬ 
lem  by  requiring  their  customers  to  take  preventive  mea¬ 
sures  or  encouraging  them  to  do  so  through  the  premium 


structure  or  copayments.  In  the  case  of  homeland  secu¬ 
rity,  the  prospect  of  moral  hazard  can  create  a  gap  be¬ 
tween  social  and  private  costs  if,  for  example,  businesses 
expect  the  government  to  compensate  them  for  major 
losses  from  an  attack. 

What  Is  the  Government’s  Role? 

If  the  social  costs  of  terrorism  exceed  the  private  costs, 
governments  may  be  able  to  help  correct  the  conse¬ 
quences  of  any  differences  between  social  and  private  per¬ 
spectives.  Broadly  speaking,  the  government  can  choose 
among  three  approaches  to  affect  the  behavior  of  busi¬ 
nesses: 

■  Internalizing  the  costs  of  security.  Policies  could  include 
new  regulations  affecting  the  behavior  of  businesses  or 
consumers.  They  could  also  include  new  taxes  or  pen¬ 
alties  that  would  raise  the  cost  of  not  undertaking  such 
activities.  The  effect  would  be  to  make  businesses, 
their  customers,  or  at-risk  populations  (such  as  the 
neighbors  of  an  at-risk  facility)  face  more  fully  the 
costs  of  potential  losses. 
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■  Socializing  the  costs  of  security.  The  government  (and 
indirectly  the  general  tax-paying  public)  could  assume 
the  costs  of  reducing  risks  and  potential  losses,  either 
by  undertaking  protective  measures  itself  or  by  financ¬ 
ing  efforts  by  businesses,  their  customers,  and  affected 
populations  to  enhance  security. 

■  Providing  better  information  for  making  security  deci¬ 
sions.  For  example,  programs  could  be  created  to  give 
businesses  and  individuals  additional  information  on 
the  risks  of  attacks,  potential  losses  from  attacks,  and 
opportunities  for  reducing  risks.  Such  programs  could 
include  information  collection  and  dissemination,  as 
well  as  research  and  development — either  by  the  gov¬ 
ernment  or,  in  response  to  regulatory  or  financial  in¬ 
centives,  by  businesses. 

Those  approaches  sometimes  overlap.  For  example,  the 
Transportation  Security  Administration  imposes  a  fee  on 
private  airlines  to  help  pay  for  government  screening  of 
passengers.  That  program  both  forces  airlines  and  their 
customers  to  internalize  costs  of  security  and,  if  the  fee 
does  not  cover  all  of  the  costs,  socializes  the  remaining 
costs  of  providing  security  by  paying  for  them  from  gen¬ 
eral  revenues. 

The  choice  among  both  general  approaches  and  specific 
options  will  depend  in  large  part  on  the  cost-effectiveness 
of  the  action — how  fully  it  improves  security  and  at  what 
cost.  In  some  instances,  the  government  will  have  a  cost 
advantage  over  the  private  sector  in  performing  an  activ¬ 
ity.  (For  example,  cost-effectiveness  was  among  the  argu¬ 
ments  used  in  support  of  the  federal  takeover  of  airline 
passenger  screening.)  Areas  where  the  government  is 
likely  to  have  a  cost  advantage  are  related  to  services  that 
the  government  already  provides,  such  as  intelligence 
gathering,  law  enforcement  (including  potential  screen¬ 
ing  of  employees),  and  research  and  development.  Simi¬ 
larly,  local  governments  have  an  advantage  in  providing 
first-responder  services. 

Some  specific  options  have  serious  drawbacks.  For  exam¬ 
ple,  making  more  information  on  terrorist  threats,  vul¬ 
nerabilities,  and  potential  losses  generally  available  means 
that  potential  terrorists  also  might  access  that  informa¬ 
tion.  Further,  not  all  communication  among  businesses 
provides  a  social  benefit.  Antitrust  concerns  cause  the 
government  to  restrict  information  sharing  among 
competitors. 


The  Government’s  Response 
Since  September  11 — Baseline 
for  Further  Change 

All  of  the  critical  industries  discussed  in  this  paper  were 
subject  to  extensive  government  intervention  before  Sep¬ 
tember  1 1  to  mitigate  the  danger  that  they — or  disrup¬ 
tion  of  their  operations — can  pose  to  public  safety,  envi¬ 
ronmental  quality,  and  the  national  or  local  economies. 
Since  that  date,  additional  measures  that  specifically  ad¬ 
dress  security  concerns  have  been  implemented.  Those 
new  programs — plus  the  earlier  ones  that  restrict  industry 
activity  to  prevent  or  mitigate  industrial  accidents,  natu¬ 
ral  disasters,  or  crime — serve  as  a  starting  point  for  identi¬ 
fying  additional  efforts  needed  to  address  an  increased 
terrorist  threat. 

Numerous  programs  are  in  the  domain  of  state  and  local 
governments.  Containing  the  losses  from  a  terrorist  at¬ 
tack  frequently  falls  to  the  emergency  first-responder  ser¬ 
vices  of  local  governments — including  the  fire,  police, 
medical  services,  and  relief-support  agencies.  State  and  lo¬ 
cal  governments  have  an  active  role  in  preparing  for 
emergencies  involving  many  of  the  critical  industries  that 
may  be  vulnerable  to  terrorist  attacks.  In  some  of  those 
industries,  state  and  local  governments  may  have  a  regula¬ 
tory  or  a  direct  ownership  role.  For  example,  local  gov¬ 
ernments  provide  electricity  services  to  many  communi¬ 
ties  and  also  own  some  of  the  nation’s  large  dams — any  of 
which  may  be  the  target  of  attack.  State  and  local  govern¬ 
ments  also  participate  in  emergency  preparedness  by  reg¬ 
ulating  activities  of  industries  that  may  be  subject  to  at¬ 
tack  and  establishing  zoning  requirements  that  restrict 
activity  near  hazardous  facilities. 

The  federal  government  responded  to  the  increased  threat 
of  terrorism  after  September  1 1  with  a  number  of  admin¬ 
istrative  and  legislative  initiatives  to  address  perceived  im¬ 
mediate  needs.  The  President  issued  a  series  of  Homeland 
Security  Presidential  Directives  establishing  a  Homeland 
Security  Council  to  coordinate  the  actions  of  federal 
agencies,  setting  up  the  homeland  security  advisory  sys¬ 
tem,  directing  changes  in  immigration  policy  and  the 
tracking  of  foreign  visitors,  and  implementing  other  mea¬ 
sures  to  reduce  the  immediate  risk  of  attack  and  spread 
information  on  the  threat.  The  Congress  also  took  a 
number  of  actions  in  the  period  immediately  following 
September  1 1  in  the  areas  of  aviation  security,  surveil¬ 
lance  powers  for  law  enforcement,  and  funding  of  state 
and  local  first  responders.  In  addition,  it  acted  to  reim- 
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burse  many  of  the  direct  victims  of  the  attacks  and  to 
limit  the  liability  of  airlines  used  in  the  attacks  by  passing, 
respectively,  the  Victims  of  Terrorism  Tax  Relief  Act  of 
2001  and  the  Air  Transportation  Safety  and  System  Sta¬ 
bilization  Act  of  200 1 . 

The  Administration  and  the  Congress  now  are  assessing 
broad  strategies  to  improve  security  that  will  be  funded 
and  overseen  by  the  Congress.  Those  include  programs  to 
facilitate  the  sharing  of  information  between  government 
and  the  private  sector  (see  Box  1-2). 

Among  the  important  new  laws  enacted  since 
September  1 1  are: 

■  The  Aviation  and  Transportation  Security  Act  of 
2001,  establishing  the  Transportation  Security  Ad¬ 
ministration  and  federalizing  airline  passenger 
screening; 

■  The  Uniting  and  Strengthening  America  by  Providing 
Appropriate  Tools  Required  to  Intercept  and  Obstruct 
Terrorism  Act  (or  the  USA  PATRIOT  Act)  of  2001, 
introducing  legislative  changes  to  increase  the  surveil¬ 
lance  and  investigative  powers  of  law  enforcement 
agencies  in  the  United  States; 

■  The  Homeland  Security  Act  of  2002,  reorganizing 
federal  agencies  to  establish  the  new  Department  of 
Homeland  Security; 

■  The  Support  Anti-Terrorism  by  Fostering  Effective 
Technologies  Act  (or  SAFETY  Act)  of  2002,  protect¬ 
ing  merchants  from  liability  for  technologies  that  do 
not  perform  as  intended  in  a  terrorist  attack; 

■  The  Terrorism  Risk  Insurance  Act  of  2002,  establish¬ 
ing  a  temporary  federal  terrorism  reinsurance  program 
to  provide  some  public  compensation  for  insured 
losses  from  terrorism; 

■  The  Public  Health  Security  and  Bioterrorism  Pre¬ 
paredness  and  Response  Act  of  2002,  authorizing  the 
creation  of  medical  stockpiles  to  prepare  for  biological 
attacks  and  other  measures; 

■  The  Maritime  Transportation  Security  Act  of  2002, 
requiring  the  Coast  Guard  and  other  agencies  to  im¬ 
prove  security  at  the  nation’s  ports  and  waterways  by 


requiring  security  assessments,  new  security  plans,  and 
new  security  measures; 

■  The  Enhanced  Border  Security  and  Visa  Entry  Re¬ 
form  Act  of  2002,  requiring  measures  to  help  counter 
illegal  aliens  and  track  potential  terrorists  in  the 
country; 

■  The  Federal  Information  Security  Management  Act  of 
2002,  requiring  measures  to  protect  federal  informa¬ 
tion  and  information  systems;  and 

■  The  Project  BioShield  Act  of 2004,  requiring  measures 
to  expand  and  expedite  the  availability  of  vaccines  and 
treatments  to  combat  potential  bioterrorism  agents. 

Among  new  legislation  that  the  Congress  is  considering 
are  measures  that  would  affect  the  reliability  of  electricity 
supplies  and  require  further  security  actions  in  such  areas 
as  civilian  nuclear  power,  air  freight,  and  chemical  facili¬ 
ties.  Also  under  consideration  are  revisions  to  some  of  the 
laws  already  enacted,  including  the  USA  PATRIOT  Act. 
The  Terrorism  Risk  Insurance  Act  is  scheduled  to  lapse  at 
the  end  of  2005,  and  bills  to  reauthorize  the  terrorism  re¬ 
insurance  program  are  before  the  Congress.*^ 

Improving  Homeland  Security — 

A  General  Framework 

This  paper  examines  additional  approaches  that  may  be 
appropriate  to  bring  incentives  for  private-sector  spend¬ 
ing  on  homeland  security  in  line  with  social  objectives. 
Many  of  those  approaches  are  under  discussion.  For  ex¬ 
ample,  the  Government  Accountability  Office  (GAO, 
formerly  the  General  Accounting  Office)  has  summarized 
the  many  recommendations  from  commissions  created 
by  the  Gongress  to  look  at  the  nation’s  security  in  gen¬ 
eral.^  Further  suggestions  have  come  from  the  National 
Research  Gouncil,  the  Brookings  Institution,  and  the 


6.  See  Congressional  Budget  Office,  Federal  Terrorism  Insurance:  An 
Update  (forthcoming,  January  2005). 

7.  General  Accounting  Office,  Homeland  Security:  Selected  Recom¬ 
mendations  from  Congressionally  Chartered  Commissions  and  GAO, 
GAO-04-591  (March  2004).  The  findings  reviewed  are  those  of 
the  National  Commission  on  Terror  (or  Bremmer  Commission), 
the  Advisory  Panel  to  Assess  Domestic  Response  Capabilities  for 
Terrorism  Involving  Weapons  of  Mass  Destruction  (or  Gilmore 
Gommission),  and  the  U.S.  Gommission  on  National  Security/ 
21st  Gentury  (or  Hart-Rudman  Gommission). 


6 


HOMELAND  SECURITY  AND  THE  PRIVATE  SECTOR 


Box  1-2. 

Government  Efforts  to  Share  Information  with  Industry 


Many  formal  and  informal  relationships  exist  to 
share  information  that  is  relevant  to  homeland  secu¬ 
rity.  Some  of  those  relationships  encompass  basic 
government  efforts  to  open  lines  of  communica¬ 
tion — describing  government  services  and  funding 
opportunities,  hosting  informational  conferences, 
and  providing  training  sessions.^  Other  federal  initi¬ 
atives,  such  as  disaster-preparedness  grants  from  the 
Federal  Emergency  Management  Agency,  involve  di¬ 
rectly  funding  the  coordination  efforts  of  local  gov¬ 
ernments  and  businesses. 

One  initiative  that  is  particularly  relevant  to  home¬ 
land  security  is  the  Information  Sharing  and  Analysis 
Centers,  or  ISACs.  ISACs  generally  are  private-sector 
organizations  (or  networks  of  organizations)  that  the 
federal  government  has  helped  create  to  disseminate 
real-time  information  on  threats  to  critical  industries 
(see  table  on  facing  page).  In  addition  to  helping  get 
the  word  out  on  imminent  threats,  ISACs  can  serve 


1 .  For  example,  see  the  description  of  public/ private  partner¬ 
ships  by  the  Department  of  Energy’s  Office  of  Assurance  at 
www.ea.doe.gov/partnerships.html. 


as  forums  to  help  coordinate  efforts  to  identify  and 
reduce  vulnerabilities. 

The  government  first  encouraged  the  development 
of  ISACs  in  1998  through  Presidential  Decision  Di¬ 
rective-63,  calling  for  ISACs  to  serve  as  a  mechanism 
for  gathering,  analyzing,  and  disseminating  private- 
sector  information  and  sharing  that  information 
with  the  government.^  ISACs  are  generally  funded 
by  membership  fees  or  federal  grants,  although  the 
ISAC  for  information  technology  is  operated  by  the 
federal  National  Communications  System,  with  par¬ 
ticipation  by  federal  agencies  and  industry.^  Some  of 
the  major  trade  organizations  represented  in  the 
ISACs  (including  the  American  Petroleum  Institute, 
the  American  Chemistry  Council,  and  the  North 
American  Electric  Reliability  Council)  have  been  ac¬ 
tive  both  in  establishing  standards  for  safety  and  se¬ 
curity  in  their  industries  and  in  working  with  local 
governments  to  plan  for  emergencies. 


2.  Presidential  Decision  Directive/NSC-63,  May  22,  1998, 
available  at  www.fas.org/irp/offdocs/pdd/pdd63.htm. 

3.  Information  on  membership  of  the  ISAC  for  information 
technology  is  available  at  www.ncs.gov/ncc/main.html. 


House  Select  Committee  on  Homeland  Security.^  GAO 
has  provided  its  own  analyses  for  specific  industries,  too, 
as  has  the  Congressional  Research  Service.  The  Congres¬ 
sional  Budget  Office  has  provided  cost  estimates  for  some 
of  the  proposals  that  have  already  been  offered  in  the 
form  of  new  legislation.^ 


8.  Michael  E.  O’Hanlon  and  others.  Protecting  the  American  Home¬ 
land  (Washington,  D.C.:  Brookings  Institution  Press,  2002); 
National  Research  Council,  Making  the  Nation  Safer:  The  Role  of 
Science  and  Technology  in  Countering  Terrorism  (Washington, 
D.C.:  National  Academies  Press,  2002);  and  Democratic  Staff  of 
the  House  Select  Committee  on  Homeland  Security,  America  at 
Risk:  Closing  the  Security  Gap  (February  2004) . 

9.  Congressional  Budget  Office  cost  estimates  are  available  at 
www.cbo.gov. 


In  this  analysis,  the  ideas  for  new  approaches  in  each  in¬ 
dustry  are  organized  into  three  areas:  approaches  that 
would  cause  private  actors  (businesses,  their  immediate 
customers,  and  the  neighbors  of  potential  physical  tar¬ 
gets)  to  internalize  more  of  the  social  costs  of  an  attack, 
those  that  would  have  the  government  and  taxpayers  as¬ 
sume  more  of  the  direct  responsibility  for  reducing  the 
social  costs  of  an  attack,  and  those  that  would  improve 
information  on  the  risks  and  costs  of  an  attack  so  that 
private  actors  could  make  better  decisions  about  security. 

The  following  example  may  help  explain  the  problem  fac¬ 
ing  policymakers.  If  a  chemical  production  facility  was 
subject  to  an  attack,  the  ensuing  fire  or  explosion  could 
expose  the  surrounding  community  to  dangerous  toxins 
as  well  as  destroy  the  facility.  That  broad  exposure  would 
represent  a  social  cost  of  continued  operation  that  would 
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Information  Sharing  and  Analysis  Centers  for  Selected  Critical  Industries^ 


ISAC 

Lead  Industry  Group(s) 

Major  Activities 

Chemical  Industry 

American  Chemistry  Council 
(Chemtrec) 

Provides  public-service  hotline  for  firefighters, 
law  enforcement,  and  other  emergency  re¬ 
sponders  to  obtain  information  on  and  assis¬ 
tance  for  emergency  incidents  involving  chemi¬ 
cals  and  hazardous  materials.  Maintains 
material-safety  information  and  emergency 
contacts  for  manufacturers  and  shippers.  More 
information  atwww.chemtrec.com. 

Electric  Power 

North  American  Electric 
Reliability  Council  (NERC) 

Disseminates  threat  indications,  analyses,  and 
warnings,  together  with  interpretations,  to  help 
participants  in  the  electricity  sector  take  protec¬ 
tive  actions.  NERC  further  coordinates  cyber 
security,  physical  security,  and  operational  secu¬ 
rity  through  its  Critical  Infrastructure  Protec¬ 
tion  Committee.  More  information  at 

WWW.  nerc.  com/  ^  filez/ cip.  html . 

Energy  (Oil  and  Gas) 

American  Petroleum  Insti¬ 
tute,  American  Gas  Associa¬ 
tion,  National  Petrochemi¬ 
cals  &  Refiners  Association 
(operated  by  Science  Appli¬ 
cations  International  Cor¬ 
poration) 

Maintains  industrywide  database  of  electronic 
security  threats,  vulnerabilities,  incidents,  and 
solutions.  Provides  a  confidential  venue  for 
sharing  security  vulnerabilities,  solutions,  and 
best  practices.  More  information  at  www. 
energyisac.com. 

Food  Industry 

Food  Marketing  Institute 

Disseminates  warnings  (from  the  Federal  Bu¬ 
reau  of  Investigation)  to  participants,  reports 
incidents,  provides  technical  expertise  to  help 
evaluate  reports,  and  coordinates  industrywide 
response  to  attack.  More  information  at 
www.fmi.org/isac/isacorgstructure.pdf 

Source:  Department  of  Homeland  Security. 

Note:  Web  links  for  all  of  those  organizations  may  be  found  at  www.dhs.gov/dhspublic/display?theme  =  73&content  =  1375 

a.  There  is  no  ISAC  for  nuclear  power.  That  function  is  covered  in  part  by  the  ISACs  for  electric  power,  surface  transportation,  and 
emergency  services.  Information  on  specific  threats  to  the  nuclear  power  industry  is  disseminated  primarily  by  the  Nuclear 
Regulatory  Commission  and  law  enforcement  agencies,  although  general  information  is  also  available  to  nuclear-plant  opera¬ 
tors  from  the  Nuclear  Energy  Institute  and  other  trade  associations. 
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exceed  the  private  costs  if  those  broad  losses  did  not  fall 
fully  on  the  facility  owner,  especially  if  the  damage  ex¬ 
ceeded  the  limits  of  the  owner’s  insurance  coverage  and 
other  financial  resources. 

In  that  situation,  the  owner’s  losses  alone  would  provide 
less  incentive  to  undertake  preventive  actions  than  would 
the  full  costs  of  an  attack. 

Many  different  types  of  programs  could  help  address  such 
a  problem.  Programs  that  would  internalize  the  costs  of 
security  could  include  requiring  the  relocation  of  an  at- 
risk  facility  (or  a  reduction  in  the  neighboring  popula¬ 
tion),  requiring  businesses  to  adopt  the  use  of  less  volatile 
materials,  or  establishing  regulations  that  would  change 
protective  services  or  production  processes.  Programs  that 
would  socialize  the  costs  could  include  providing  tax  in¬ 
centives  or  direct  subsidies  for  businesses  to  add  physical 
protections  or  to  adopt  the  use  of  less  volatile  materials 
and  increasing  public  funding  for  local  emergency  ser¬ 
vices.  Information  programs  could  include  helping  local 
populations  learn  about  risks  and  plan  for  contingencies. 


Scope  of  the  Analysis 

This  paper  aims  to  develop  a  useful  framework  for  think¬ 
ing  about  homeland  security  policies  and  to  formulate 
ideas  for  new  programs  in  the  context  of  that  framework. 
Those  ideas  are  all  subject  to  limitations  and  caveats.  First 
and  foremost,  because  the  costs  of  a  terrorist  attack  in 
each  industry  cannot  be  known,  the  return  from  imple¬ 
menting  the  approaches  outlined  here  cannot  be  known. 
Also,  this  paper  does  not  present  the  options  in  detail; 
thus,  a  cost-benefit  analysis  of  them  is  not  possible.  In¬ 
stead,  the  paper  generally  characterizes  the  economic  ef¬ 
fects  of  different  options,  noting  their  impact  on  resource 
allocation  and,  where  possible,  the  magnitude  of  their 
cost.  In  some  cases,  it  could  be  inferred  that  additional  se¬ 
curity  motivated  solely  by  potential  terrorist  attacks  is  not 
likely  to  be  worthwhile. 

Further,  this  analysis  is  limited  in  that  it  narrowly  focuses 
on  four  industries.  Terrorists  could  well  choose  targets 
that  are  not  a  part  of  those  industries.  Regarding  alterna¬ 
tive  targets,  a  target’s  attractiveness  to  terrorists  is  gener¬ 
ally  thought  to  depend  in  part  on  the  security  of  other 
potential  targets.  That  is,  the  various  options  described 
here  may  not  achieve  their  full  potential  to  enhance  total 
security  if  they  cause  terrorists  to  look  elsewhere. 
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H  W  H  embers  of  the  terrorist  group  that  attacked  the 
World  Trade  Center  and  the  Pentagon  on  September  11, 
200 1 ,  indicated  that  they  also  were  interested  in  attacking 
the  nation’s  nuclear  power  plants.  That  information,  in 
the  context  of  an  increased  national  threat,  is  drawing  at¬ 
tention  to  concerns  about  the  vulnerability  of  nuclear  re¬ 
actor  cores  and  the  spent  nuclear  material  stored  at  power 
plants,  as  well  as  the  need  to  guard  nuclear  material  in 
transit  and  at  different  stages  of  production.  Two  notable 
accidents  involving  nuclear  plants — Chernobyl  in 
Ukraine  and  Three  Mile  Island  outside  Harrisburg, 
Pennsylvania — indicate  the  potential  losses  from  an  at¬ 
tack,  as  do  studies  of  the  possible  consequences  of  acci¬ 
dental  releases.  This  chapter  focuses  on  security  concerns 
associated  with  nuclear  power  used  for  electricity  genera¬ 
tion.  It  excludes  concerns  about  the  use  of  low-level  ra¬ 
dioactive  materials  in  medical  applications,  research,  and 
food  irradiation — large  amounts  of  which  would  be 
needed  to  fashion  any  kind  of  weapon.  ^ 

Vulnerabilities  from  Attacks  on  Power 
Reactors  and  Spent  Material 

The  staff  of  the  National  Commission  on  Terrorist  At¬ 
tacks  Upon  the  United  States  reports  that  a  precursor  to 
the  September  1 1  plan  included  crashing  two  airplanes 
into  two  unspecified  nuclear  plants.^  In  2003,  Energy 


1 .  For  a  discussion  of  security  issues  involving  low-level  radioactive 
material,  see  General  Accounting  Office,  Federal  and  State  Action 
Needed  to  Improve  Security  of  Sealed  Radioactive  Sources,  GAO-03- 
804  (August  2003). 

2.  “Outline  of  the  9/11  Plot”  (Staff  statement  no.  16  to  the  National 
Commission  on  Terrorist  Attacks  Upon  the  United  States,  June 
16,  2004),  p.  13,  available  at  www.mipt.org/pdf/NCTAUTUS- 
staff-statement-16.pdf  Also  see  reports  by  CNN  on  an  internal 
memorandum  of  the  Nuclear  Regulatory  Commission  citing  the 
debriefing  of  a  senior  al  Qaeda  operative,  available  at 
www.cnn.eom/2002/US/0 1/31 /ret.  terror,  threats/. 


Secretary  Spencer  Abraham  said  there  was  evidence  that 
terrorists  may  have  specifically  targeted  the  Palo  Verde 
nuclear  power  plant  near  Wintersburg,  Arizona — the 
largest  commercial  nuclear  facility  in  the  country.^  A  year 
earlier,  a  National  Research  Council  report  concluded 
that  nuclear  power  plants  “may  present  a  tempting  high- 
visibility  target  for  terrorist  attack,  and  the  potential  for  a 
September  1 1-type  surprise  attack  in  the  near  term  using 
U.S.  assets  such  as  airplanes  appears  to  be  high.”'^ 

Where  Nuclear  Plants  Are  Vulnerable 

Nuclear  facilities  and  nuclear  materials  in  the  private  sec¬ 
tor  could  present  several  different  types  of  targets  to  a  ter¬ 
rorist — wherever  nuclear  fuels  are  produced,  transported, 
and  consumed,  and  wherever  production  wastes  are  accu¬ 
mulated.^  Currently,  104  licensed  nuclear  reactors  are  op¬ 
erating  at  65  power  plants  in  31  states;  they  supply  about 
20  percent  of  the  nation’s  electricity.*^ 

Power  plant  operators  are  most  concerned  about  direct 
attacks  and  sabotage  that  may  target  nuclear  reactors  or 
the  spent  fuel  stored  by  nuclear  plants.  (If  the  govern¬ 
ment  proceeds  with  plans  to  transport  spent  material  to 
long-term  storage  facilities,  the  security  of  material  in 
transit  also  will  become  a  concern.)  Reactor  cores  are  con¬ 
tained  in  concrete  structures  to  prevent  accidental  releases 


3.  Statement  of  Spencer  Abraham,  Secretary  of  Energy,  before  the 
Senate  Committee  on  Armed  Services,  March  20,  2003,  available 
at  armed-services.senate.gOv/statemnt/2003/March/Abraham.pdf. 

4.  National  Research  Council,  Making  the  Nation  Safer:  The  Role  of 
Science  and  Technology  in  Countering  Terrorism  (Washington, 
D.C.:  National  Academies  Press,  2002),  p.  50. 

5.  For  a  review,  see  Congressional  Research  Service,  Nuclear  Power 
Plants:  Vulnerability  to  Terrorist  Attack,  CRS  Report  for  Congress 
RS21131  (updated  September  17,  2004). 

6.  Congressional  Research  Service,  Nuclear  Energy  Policy,  CRS  Issue 
Brief  IB88090  (updated  October  26,  2004),  pp.  1-2. 
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of  radiation — a  design  feature  that  also  can  afford  some 
protection  against  physical  assaults.  To  further  limit  the 
possibility  that  a  ground  attack  or  internal  sabotage  could 
cause  a  major  release  of  radioactive  material,  facilities  ob¬ 
serve  internal  safeguards  (such  as  backup  electric  power 
for  pumps)  and  take  measures  to  ensure  secure  perime¬ 
ters.  Further,  the  Nuclear  Regulatory  Commission 
(NRC)  requires  background  checks  of  all  nuclear  opera¬ 
tions.^  The  NRC  periodically  issues  directives  on  the 
types  of  attacks  that  its  licensees  must  protect  against. 
The  latest  directive  requires  plants  to  prepare  for  the 
“largest  reasonable  threat  against  which  a  regulated  pri¬ 
vate  guard  force  should  be  expected  to  defend  under  ex¬ 
isting  law.”^  However,  NRC  policy  specifically  exempts 
nuclear  plants  in  the  United  States  from  any  requirement 
to  be  built  or  operated  “for  the  specific  purpose  of  protec¬ 
tion  against  the  effects  of  (a)  attacks  and  destructive  acts, 
including  sabotage,  directed  against  the  facility  by  an  en¬ 
emy  of  the  United  States  ...  or  (b)  use  or  deployment  of 
weapons  incident  to  U.S.  defense  activities.”^ 

Nuclear  power  plants  are  also  vulnerable  to  attacks  on  the 
large  quantities  of  spent  nuclear  fuel  stored  on-site.^*' 
That  fuel,  which  is  held  outside  the  reactor  core  contain¬ 
ment  structures,  may  be  more  vulnerable  than  the  reactor 
cores.  Most  of  the  spent  material  currently  is  stored  in 
cooling  pools.  At  some  plants,  the  storage  areas  for  those 
pools  are  built  with  thick  concrete  walls  and  located  par¬ 
tially  below  ground  level,  which  would  afford  them  some 
protection.  But  at  other  plants,  the  pools  are  covered  only 
by  lightly  constructed  steel  frame  buildings.  Regardless, 


7.  The  Nuclear  Energy  Institute,  a  trade  group  representing  the 
industry,  provides  brief  descriptions  of  security  measures  at 
nuclear  plants  (available  at  www.nei.org/index.aspicatum 
=2&catid=274)  and  of  the  special  security  for  reactor  cores 
(available  at  www.nei.org/index.asp?catnum=2&catid=276). 

8.  For  a  discussion  of  the  most  recent  directives,  known  as  a  design 
basis  threat,  see  Government  Accountability  Office,  Nuclear  Regu¬ 
latory  Commission:  Preliminary  Observations  on  Ejforts  to  Improve 
Security  at  Nuclear  Power  Plants,  GAO-04-1064T  (September  14, 
2004). 

9.  10  G.F.R.  50.13. 

10.  See  Robert  Alverez  and  others,  “Reducing  the  Hazards  from 
Stored  Spent  Power-Reactor  Fuel  in  the  United  States,”  Science 
and  Global  Security,  vol.  11,  no.  1  (2003),  pp.  1-60.  For  a  critique, 
see  Nuclear  Regulatory  Gommission,  Fact  Sheet  on  NRC  Review  of 
Paper  on  Reducing  Hazards  from  Stored  Spent  Nuclear  Fuel  (August 
2003),  available  at  www.nrc.gov/reading-rm/doc-collections/fact- 
sheets/reducing-hazards-spent-fuel.html. 


the  fuel  stored  in  those  pools  would  remain  at  risk  to  any 
attack  that  harmed  the  water  cooling  systems.  As  the  ra¬ 
dioactivity  of  the  spent  fuel  diminishes  with  time,  some 
of  the  fuel  can  be  moved  to  storage  in  dry  casks,  where  its 
low  radioactivity  makes  it  of  less  concern.  At  the  end  of 
2002,  U.S.  electric  utilities  were  holding  more  than 
47,000  metric  tons  of  spent  nuclear  fuel,  in  both  wet  and 
dry  storage,  accumulated  from  about  35  years  of  nuclear 
power  generation.  ^  ^ 

A  terrorist  attack  could  cause  greatest  harm  if  radioactive 
materials  were  released,  whether  as  a  direct  consequence 
of  an  explosion  or  an  ensuing  fire  or  as  an  indirect  conse¬ 
quence  of  disabling  a  plant’s  cooling  systems  or  other  sys¬ 
tem  safeguards.  Any  attack  that  breached  the  contain¬ 
ment  structure  for  the  reactor  core  or  the  spent  fuel  kept 
in  wet  or  dry  storage  could  cause  an  explosion  or  fire.  An 
attack  that  resulted  in  coolant  loss  in  the  reactor  core 
could  lead  to  core  damage  or  a  melting  of  the  fuel. 

Other  systems  at  risk  in  a  nuclear  power  plant  include 
electricity  supplies,  circulation  pumps,  the  intakes  for 
cooling  water,  and  other  piping.  Problems  in  any  of  those 
areas  could  cause  temperatures  to  rise  excessively  or  lead 
to  excessive  steam  pressure.  An  attack  could  also  compli¬ 
cate  the  shutdown  of  the  fission  process.  Normally,  oper¬ 
ators  insert  neutron-absorbing  control  rods  among  the 
uranium  fuel  rods  in  the  reactor  core  or  remove  the  fuel 
rods  altogether  to  halt  fission.  Without  water,  the  fission 
process  would  stop,  but  removing  the  fuel  from  the  core 
at  that  point  would  be  nearly  impossible,  and  the  radioac¬ 
tive  material  could  be  spread  by  any  fire.  (In  the  event  of 
a  fire,  radioactive  material  might  be  vented  unintention¬ 
ally  to  the  outside  even  if  the  walls  of  the  containment 
structure  for  the  reactor  core  were  not  breached.) 

Concerning  the  intentional  crashing  of  a  large  aircraft, 
research  provides  conflicting  information  about  how  well 
the  reactor  core  or  spent-fuel  storage  areas  of  a  nuclear 
plant  could  withstand  such  an  assault.  For  example,  the 
Electric  Power  Research  Institute  conducted  a  study  for 
the  Nuclear  Energy  Institute  using  a  computer  simulation 
of  a  wide-bodied  aircraft  striking  a  nuclear  plant.  It  con¬ 
cluded  that  although  the  structure  housing  spent  fuel 
could  be  breached,  cooling  water  would  not  be  lost,  and 


1 1 .  Department  of  Energy,  Energy  Information  Administration, 
Detailed  U.S.  Spent  Nuclear  Fuel  Data  as  of  December  31,  2002 
(October  1,  2004),  available  atwww.eia.doe.gov/cneaf/nuclear/ 
spent_fuel/ ussnfdata.html. 
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the  concrete  containment  structure  for  the  reactor  would 
not  be  ruptured.  In  contrast,  the  Nuclear  Control  Insti¬ 
tute  reported  that  by  its  calculations,  a  Boeing  767  could 
penetrate  at  least  3  feet  of  reinforced  concrete  at  a  full 
cruising  speed  of  530  miles  per  hour.^^  (Typical  reactor 
containment  structures  have  walls  316  feet  to  6  feet 
thick.)  Variables  that  would  determine  actual  vulnera¬ 
bility  to  attack  by  air  include  the  plane’s  size,  the  speed 
and  angle  of  descent,  and  the  amount  of  fuel  (or  other  ex¬ 
plosives)  on  board,  as  well  as  the  topography  of  the  area 
and  the  design  of  the  plant  and  other  structures.  An  air¬ 
craft  collision  that  disrupted  water  cooling  and  external 
safety  equipment  could  start  a  fire  even  without  fully 
penetrating  the  containment  structure. 

History  of  Accidents  and  Assaults 

The  nature  of  technological  vulnerabilities  is  revealed  by 
the  history  of  safety  incidents  involving  nuclear  plants 
(including  civilian,  military,  and  research  facilities),  ura¬ 
nium  enrichment  facilities,  and  nuclear  material  in  transit 
that  have  caused  or  threatened  the  release  of  radioactive 
material.  Among  such  incidents,  the  accidents  at  Cher¬ 
nobyl  in  1986  and  Three  Mile  Island  in  1979  are  the 
most  noteworthy. 


12.  See  Nuclear  Energy  Institute,  Deterring  Terrorism:  Aircraft  Crash 
Impact  Analyses  Demonstrate  Nuclear  Power  Plant’s  Structural 
Strength  (December  2002),  available  at  www.nei.org/documents/ 
eprinuclearplantstructuralstudy200212.pdf. 

13.  Letter  from  the  Nuclear  Control  Institute  and  the  Committee  to 
Bridge  the  Gap  to  Richard  Meserve,  Chairman  of  the  Nuclear 
Regulatory  Commission,  September  14,  2001,  available  at 
www.nci.org/01nci/09/letter-mserve-l4.htm. 

14.  Paul  Gaukler,  D.  Sean  Barnett,  and  Douglas}.  Rosinski,  “Nuclear 
Energy  and  Terrorism,”  Natural  Resources  &  Environment,  vol. 

16,  no.  3  (Winter  2002),  available  at  www.abanet.org/environ/ 
pubs/ nre/ specissue/ gauklerbarnettrosinski.pdf. 

15.  For  information  on  collective  radiation  exposure,  unplanned  capa¬ 
bility  losses,  and  industrial  safety  involving  U.S.  nuclear  plants, 
see  Institute  of  Nuclear  Power  Operations,  2002  Performance  Indi¬ 
cators  for  the  U.S.  Nuclear  Industry,  available  at  www.nei.org/ 
documents/Wano_Perfo rmance_Indicators_2002.pdf  For  inter¬ 
national  safety  statistics,  see  World  Association  of  Nuclear  Opera¬ 
tors,  WANO  Performance  Indicators  2002  (London:  WANO,  June 
2003),  available  at  www.wano.org.uk/PerformanceIndicators/ 
PI_Trifold/PI_2002_TriFold.pdf.  For  a  list  of  incidents  involving 
nuclear  materials,  see  Wm.  Robert  Johnston,  Nuclear  Terrorism 
Incidents  (September  23,  2003),  available  at  www.johnstons 
archive  .net/ nuclear/ wrj p  1 8 5  5 .  html . 


Further  evidence  of  nuclear  plants’  direct  vulnerability  to 
attack  comes  from  the  history  of  actual  assaults  on  nu¬ 
clear  facilities.  Although  plants  in  the  United  States  have 
not  experienced  an  armed  assault,  much  less  a  large-scale 
attack,  facilities  in  other  countries  have  been  attacked  by 
politically  motivated  groups.  Among  those  events  were 
multiple  assaults  by  Basque  separatists  in  Spain,  multiple 
attacks  by  Chechen  fighters  in  Russia,  an  apartheid-era 
attack  by  ground  forces  in  South  Africa,  and  a  rocket 
attack  in  France. 

Future  attacks  in  the  United  States  could  come  on  the 
ground  (possibly  using  high  explosives  or  military  weap¬ 
ons  such  as  rocket-propelled  grenades)  or  involve  a  colli¬ 
sion  by  a  large  or  small  aircraft  loaded  with  explosives.  To 
counter  potential  ground  attacks,  plants’  security  guards 
now  generally  train  to  prevent  intruders  from  taking  over 
a  facility  or  causing  harm  at  close  quarters.  NRC-super- 
vised  mock  attacks  involve  lightly  armed  attackers  and 
periodic  tests  of  those  security  measures  suggest  that 
weaknesses  may  exist. 

Potential  Losses  from  Exposure 
to  Radioactivity  and  Destruction  of 
Power  Facilities 

The  human,  environmental,  and  economic  costs  from  a 
successful  attack  on  a  nuclear  power  plant  that  results  in 
the  release  of  substantial  quantities  of  radioactive  material 
to  the  environment  could  be  great.  The  losses  from  an  at¬ 
tack  on  civilian  nuclear  facilities  could  include  not  just 
the  immediate  personal  injury  and  economic  and  envi¬ 
ronmental  damage  but  also  the  long-term  harm.  People 
who  survive  initial  exposure  to  substantial  amounts  of 
radiation  will  remain  at  an  elevated  risk  for  reproductive 
problems  and  cancer  for  their  entire  lives.  Other  people 
will  face  continued  risk  of  exposure  to  any  radioactive 
material  that  remains  in  the  environment.  Further  costs 
include  the  loss  of  electricity-generating  capacity  and  ex¬ 
penses  required  for  a  best-effort  cleanup  and  decontami¬ 
nation  of  the  attack  site.  In  2002,  the  National  Research 


16.  For  additional  information  on  terrorist  attacks  on  nuclear  power 
plants,  see  Gavin  Cameron,  “Nuclear  Terrorism  Reconsidered,” 
Current  History,  vol.  99  (April  2000),  pp.  154-157. 

17.  For  discussions  of  concerns  about  security  preparedness,  see 
Nuclear  Control  Institute  letter  to  the  Chairman  of  the  Nuclear 
Regulatory  Commission,  September  14,  2001;  and  Government 
Accountability  Office,  Nuclear  Regulatory  Commission:  Preliminary 
Observations  on  Efforts  to  Improve  Security  at  Nuclear  Power  Plants. 
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Council  concluded  that  a  September  1 1-type  attack 
could  have  “severe  consequences”  depending  on  the  scale 
of  the  attack  and  the  design  of  the  plant  involved. 

Studies  of  Health  Costs 

Research  on  health  threats  from  large-scale  radiation  ex¬ 
posure  has  yielded  considerable  disagreement  over  what 
constitutes  a  reasonable  worst-case  scenario  to  analyze — 
in  terms  of  how  an  accident  could  occur,  how  far  radioac¬ 
tive  material  could  be  dispersed,  and  how  effective  the 
emergency  response  would  be.  In  studies  that  have  shown 
large  potential  losses,  the  probability  of  such  accidents 
was  deemed  minuscule.  In  one  study  of  nuclear  reactor 
cores  conducted  in  the  early  1980s  for  the  NRC,  Sandia 
National  Laboratories  reported  on  the  likelihood  of 
deaths  and  injuries  from  accidents  at  individual  reactors 
across  the  country.  It  evaluated  an  extreme  scenario  that 
assumed  a  full  release  of  nuclear  materials,  worst-case  at¬ 
mospheric  conditions,  and  no  emergency  response.  For 
reactors  near  population  centers,  the  potential  losses  were 
quite  high,  with  the  most  extreme  being  from  a  severe  re¬ 
lease  from  one  of  the  reactors  in  Limerick,  Pennsylvania, 
northwest  of  Philadelphia — more  than  75,000  fatalities 
within  a  year  of  the  accident,  about  700,000  injuries  in 
the  same  time  frame,  and  about  $200  billion  in  costs  (not 
adjusted  for  inflation).  In  a  separate  study  for  the  NRC, 
Brookhaven  National  Laboratory  considered  the  conse¬ 
quences  of  a  severe  accident  involving  only  spent  fuel  and 
concluded  that  such  an  accident  could  cause  up  to 
20,000  cancer  fatalities  and  nearly  $60  billion  in  dam¬ 
ages. 

Such  estimates  are  fraught  with  uncertainty.  For  example, 
according  to  the  NRC,  the  Brookhaven  study’s  estimate 
overstates  the  scope  of  radiation  release  that  is  reasonable 
to  consider,  even  in  a  worst  case.^^  However,  loss  and 
probability  assessments  based  on  accidental  occurrences, 
such  as  the  estimate  in  that  study,  were  not  prepared  with 


18.  National  Research  Council,  Making  the  Nation  Safer,  p.  43. 

19.  Sandia  National  Laboratories,  Technical  Guidance  for  Siting  Crite¬ 
ria  Development,  NUREG/CR-2239,  SANDS  1-1 549  (November 
1982). 

20.  Brookhaven  National  Laboratory,  “Severe  Accidents  in  Spent  Fuel 
Pools  in  Support  of  Generic  Safety  Issue  82,”  BNL  Report 
NUREG/CR-4982,  1997,  published  in  Science  and  Global  Secu¬ 
rity  (Spring  2003). 


terrorist-instigated  events  in  mind.  The  extreme  circum¬ 
stances  of  a  full  release  and  an  impeded  emergency  re¬ 
sponse  might  indeed  be  relevant  for  a  terrorist  attack  and 
could  be  useful  in  deciding  how  to  prioritize  security  ef¬ 
forts. 

Evidence  of  Potential  Losses  from  Past  Accidents 

Some  indication  of  potential  losses  comes  from  the  Cher¬ 
nobyl  and  Three  Mile  Island  accidents — events  in  which 
many  unanticipated  circumstances  combined.  Chernobyl 
in  particular  demonstrates  the  consequences  of  a  broad 
dispersal  of  nuclear  material  and  an  impeded  emergency 
response — although  even  in  that  case,  conditions  could 
have  been  worse.  The  fire  and  meltdown  at  Chernobyl  re¬ 
sulted  from  a  coincidence  of  design  deficiencies  (not 
present  in  U.S.  reactors),  workers’  violations  of  standard 
procedures,  and  the  lack  of  a  “safety  culture”  in  the  re¬ 
sponsible  organizations.^^  The  operators  had  bypassed  or 
disconnected  important  safety  systems,  including  emer¬ 
gency  cooling  and  backup  power,  as  part  of  an  experi¬ 
ment  to  increase  power  output.  After  the  fire  started,  the 
operators  and  the  Soviet  government  did  not  give  prompt 
warnings  about  the  fire  and  the  release  of  radioactive  ma¬ 
terial.  The  fire,  largely  fueled  by  the  graphite  core  of  the 
reactor,  spread  radioactive  substances  across  northern  Eu¬ 
rope.  Because  the  power  plant  was  built  without  a  full 
concrete  containment  structure,  the  meltdown  also  al¬ 
lowed  radioactive  materials  to  burn  down  into  the 
ground  and  contaminate  groundwater.  A  concrete  “sar¬ 
cophagus”  was  subsequently  built  around  the  core  to 
limit  further  contamination. 

Some  50,000  square  miles  of  land  in  Ukraine,  Belarus, 
and  Russia  were  contaminated  to  the  extent  that  the 
health  of  local  residents  and  the  safety  of  agricultural 


21 .  Tbe  Nuclear  Regulatory  Commission’s  critique  of  that  study  is 
available  at  wvvw.nrc.gov/reading-rm/doc-collections/fact-sheets/ 
reducing-hazards-spent-fuel.html. 

22.  See  summary  of  the  Proceedings  of  the  International  Conference  on 
One  Decade  After  Chernobyl:  Summing  up  the  Consequences  of  the 
Accident,  jointly  sponsored  by  the  European  Commission,  the 
International  Atomic  Energy  Agency,  and  the  World  Elealth 
Organization  in  cooperation  with  the  United  Nations,  held  in 
Vienna,  Austria,  April  8-12,  1996,  available  at  www.dcisc.org/ 
chernobyl.html. 
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products  were  jeopardized.^^  According  to  the  Congres¬ 
sional  Research  Service  (CRS),  studies  indicate  that  at 
least  31  people  died  outright  from  radiation  exposure  and 
other  injuries  during  the  fire.^^  Since  that  time,  about 
1 ,000  cases  of  thyroid  cancer  in  children  have  been  re¬ 
ported  in  the  region  surrounding  the  reactor,  or  100 
times  more  cases  than  before  the  accident.  (Thyroid  can¬ 
cer  can  result  from  exposure  to  radioactive  iodine,  which 
accumulates  in  the  thyroid  gland  of  growing  children.) 
And  workers  involved  in  accident  cleanup  have  experi¬ 
enced  an  increased  death  rate.  Among  the  economic 
costs,  the  people  of  Chernobyl  and  nearby  communities 
had  to  permanently  relocate,  and  agricultural  lands  were 
permanently  contaminated. 

The  incident  at  Three  Mile  Island  was  much  less  severe 
than  the  one  at  Chernobyl.  The  Three  Mile  Island  acci¬ 
dent  was  triggered  when  the  main  feed  water  pumps 
stopped,  steam  pressure  began  to  build,  and  a  safety  valve 
designed  to  relieve  that  pressure  stuck  open,  allowing 
coolant  to  flow  out  of  the  reactor  core.  The  Pennsylvania 
power  plant  had  a  containment  structure  and  was  able  to 
withstand  a  partial  meltdown  of  the  reactor  core,  al¬ 
though  there  had  been  fears  of  an  explosion  and  breach  of 
containment.  Also,  its  reactor  core  was  not  constructed 
with  graphite,  which  had  made  the  Chernobyl  fire  so  dif¬ 
ficult  to  contain.  In  the  end,  some  highly  radioactive  ma¬ 
terial  did  escape  into  the  atmosphere  before  the  reactor 
could  be  shut  down.^^ 

CRS  points  to  studies  indicating  that  even  that  brief  pub¬ 
lic  exposure  may  ultimately  cause  perhaps  five  deaths  over 
the  ensuing  30  years.  At  the  time  of  the  accident,  nearly 
150,000  people  left  their  homes  until  the  situation  was 
stabilized.  The  Susquehanna  River,  along  which  the  nu¬ 
clear  facility  was  located,  flows  past  productive  farmland 


23.  For  information  on  the  city  of  Chernobyl  and  the  broader  exposed 
populations  of  Belarus,  Ukraine,  and  Russia,  see  David  R.  Mar- 
pies,  “The  Chernobyl  Disaster:  Its  Effect  on  Belarus  and 
Ukraine,”  in  James  K.  Mitchell,  ed..  The  Long  Road  to  Recovery: 
Community  Responses  to  Industrial  Disaster  (New  York:  United 
Nations  University,  1996),  available  at  www.unu.edu/unupress/ 
unupbooks/ uu2 1  le/  uu2 1  le0h.htm. 

24.  Congressional  Research  Service,  Nuclear  Energy  Policy  (updated 
October  26,  2004). 

25.  For  a  chronology  of  events,  see  Nuclear  Regulatory  Commission, 
Fact  Sheet  on  the  Accident  at  Three  Mile  Island  (March  2004),  avail¬ 
able  at  www.nrc.gov/reading-rm/doc-collections/fact-sheets/ 
3mile-isle.html. 


surrounding  Harrisburg  and  into  the  Chesapeake  Bay. 
The  Philadelphia,  New  York,  and  New  Jersey  population 
centers  are  immediately  downwind. 

Information  on  the  costs  of  the  Three  Mile  Island  inci¬ 
dent  to  the  nuclear  industry  comes  from  court  settle¬ 
ments,  facility  losses,  and  a  changed  investment  environ¬ 
ment.  Expenses  arising  from  claims  and  litigation  to  date 
total  about  $70  million,  mainly  for  costs  relating  to  the 
evacuation. The  courts  also  required  that  the  plant  op¬ 
erator  finance  a  fund  to  pay  for  continued  monitoring  of 
local  health.  By  far  the  biggest  costs  were  from  the  loss  of 
Three  Mile  Island’s  Unit  2,  which  had  cost  rate  payers 
$700  million  to  build,  and  the  approximately  $1  billion 
spent  to  defuel  the  facility  and  decontaminate  the 
grounds.  In  1995,  retirement  costs  for  the  destroyed  unit 
were  estimated  to  be  $399  million  for  radiological  de¬ 
commissioning  and  $34  million  for  nonradiological  re¬ 
moval. The  incident  also  precipitated  a  broad  market 
reassessment  of  nuclear  power;  dozens  of  plants  in  plan¬ 
ning  or  under  construction  at  the  time  were  canceled,  at  a 
direct  cost  to  rate  payers  across  the  country,  and  no  utili¬ 
ties  in  the  United  States  have  ordered  new  units  since 
then. 

Current  Programs  for  Plant  Safety, 
Control  over  Nuclear  Materials,  and 
Compensation  for  Losses 

The  Nuclear  Regulatory  Commission  has  principal  au¬ 
thority  for  regulating  civilian  nuclear  power  and  can  bal¬ 
ance  incentives  between  producing  power  and  ensuring 
safety  and  security.  Concerns  about  the  safe  disposal  of 
high-level  radioactive  wastes  are  being  addressed  (al¬ 
though  not  yet  resolved)  through  programs  of  the  De¬ 
partment  of  Energy  (DOE),  financed  in  part  by  industry 
contributions  to  the  Nuclear  Waste  Fund.  Separately, 
through  the  Price-Anderson  Act,  the  federal  government 
has  acted  to  address  the  negative  impact  on  industry  of 
uncertainty  about  accidents,  and  DOE  supports  the  in¬ 
dustry  by  financing  research  and  development  of  new 
production  technologies. 


26.  See  Nuclear  Energy  Institute,  Price-Anderson  Act  Provides  Ejfective 
Nuclear  Insurance  at  No  Cost  to  the  Public  (September  2003),  avail¬ 
able  at  www.nei.org/doc.asp?catnum=4&catid=3I9&docid=&for- 
mat=print. 

27.  As  reported  by  Eric  Epstein  in  Three  Mile  Island  at  Nineteen  (April 
3,  1998),  available  at  www.dep.state.pa.us/dep/pa_env-her/tmi/ 
tmiepstein.htm. 
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Regulating  the  Safety  of  Nuclear  Power  Operations 

The  Nuclear  Regulatory  Commission  is  the  principal  fed¬ 
eral  agency  tasked  with  regulating  civilian  use  of  nuclear 
materials. It  was  established  in  1974,  when  the  Con¬ 
gress  acted  to  separate  the  regulatory  role  of  the  Atomic 
Energy  Commission  from  what  many  people  viewed  as 
that  agency’s  role  in  advocating  nuclear  power.  The  NRC 
oversees  the  safety  and  security  of  nuclear  reactors  (in¬ 
cluding  their  construction,  operation,  and  decommis¬ 
sioning),  production  and  transportation  of  nuclear  mate¬ 
rials  (including  uranium  oxide,  uranium  hexafluoride, 
and  enriched  uranium),  storage  and  transportation  of 
spent  fuel,  and  disposal  of  high-level  waste.  (Under  agree¬ 
ments  with  the  NRC  and  subject  to  NRC  minimum 
standards,  the  states  may  regulate  low-level  radioactive 
materials,  including  materials  used  by  medical,  research, 
and  food  irradiation  facilities,  as  well  as  disposal  sites  for 
low-level  wastes.) 

Other  federal  agencies  are  involved  as  well.  DOE  is  di¬ 
rectly  responsible  for  developing  disposal  sites  for  high- 
level  wastes,  and  the  Environmental  Protection  Agency 
(EPA)  is  responsible  for  developing  environmental  stan¬ 
dards  for  such  sites.  However,  the  NRC  licenses  the  con¬ 
struction  and  operation  of  disposal  and  storage  sites.  It 
coordinates  its  security  program  with  the  Department  of 
Homeland  Security  (including  the  Federal  Emergency 
Management  Agency)  and  other  federal  agencies  and 
with  state  and  local  emergency  planners. 

Through  its  licensing  process,  the  NRC  helps  ensure  the 
safety  of  nuclear  power  plants  by  requiring  that  they  be 
built  with  important  safeguards  such  as  automatic  shut¬ 
down  mechanisms  and  backup  electricity  supplies.  It  also 
requires  that  operators  regularly  test  nearby  air  and  water 
for  radiation  leaks.  The  NRC  has  established  rules  gov¬ 
erning  preparations  for  various  classes  of  threats  and  re¬ 
quiring  that  plants  be  secure  against  ground  attacks  and 
inside  saboteurs.  In  addition  to  approving  plants’  security 
measures  as  a  precondition  to  licensing,  the  NRC  con¬ 
ducts  security  drills  to  test  those  defenses. 

The  NRC  requires  that  emergency  plans  include  prepara¬ 
tions  for  evacuation  or  other  actions  to  protect  residents 
in  the  vicinity  of  nuclear  plants  in  the  event  of  a  serious 
incident.^^  Each  plant  must  have  on-site  and  off-site 


28.  The  NRC’s  regulatory  authority  is  described  on  the  agency’s  Web 
site,  www.nrc.gov. 


emergency  plans.  For  on-site  planning  and  response,  the 
NRC  takes  the  lead  in  reviewing  and  assessing  operators’ 
plans.  For  off-site  planning,  the  Federal  Emergency  Man¬ 
agement  Agency  (FEMA)  has  the  lead  role  in  reviewing 
and  assessing  operators’  emergency  plans  and  in  assisting 
state  and  local  governments. 

For  planning  purposes,  the  NRC  defines  two  emergency 
planning  zones  (EPZs)  around  each  nuclear  power 
plant — one  circling  at  a  1 0-mile  radius  and  the  other  cir¬ 
cling  50  miles.  The  10-mile  EPZ  reflects  the  potential 
area  in  which  people  could  be  directly  exposed  to  the  air¬ 
borne  radioactive  material  released  in  a  fire.  The  50-mile 
EPZ  is  described  as  the  area  in  which  people  could  be  ex¬ 
posed  by  the  ingestion  of  contaminated  food  and  water. 
The  size  and  configuration  of  the  zones  may  vary  from 
plant  to  plant  because  of  local  emergency-response  needs 
and  capabilities,  as  determined  by  the  number  of  people, 
the  terrain,  access  routes,  and  local  government  bound¬ 
aries.  The  emergency  response  within  the  10-mile  EPZ 
calls  for  providing  emergency  shelter  or  evacuation  and 
using  potassium  iodide  (a  medication  to  reduce  absorp¬ 
tion  of  radioactive  isotopes  of  iodine  in  children’s  thy¬ 
roids).  The  response  for  the  50-mile  EPZ  calls  for  limit¬ 
ing  access  to  the  area  and  halting  the  distribution  of 
potentially  contaminated  food  and  water. 

Since  the  NRC  was  established,  it  has  modified  security- 
plan  requirements  for  its  licensed  nuclear  plants  several 
times,  partly  in  response  to  new  information  on  the  na¬ 
ture  of  threats.^®  Since  1977,  plants  have  been  required 
to  add  physical  barriers  that  protect  vital  equipment  and 
restrict  access,  upgrade  alarm  and  electronic  security  sys¬ 
tems,  and  maintain  minimum  numbers  of  armed  guards. 
In  1993,  plants  had  to  specifically  address  the  ground 
threat  from  a  vehicle  bomb  by  installing  vehicle  barriers. 
And  in  2003,  plants  were  required  more  generally  to  ad¬ 
dress  the  “largest  reasonable  threat  against  which  a  regu¬ 
lated  private  guard  force  should  be  expected  to  defend.” 
On  several  occasions  since  the  attacks  of  September  1 1 , 
some  states  have  ordered  National  Guard  units  to  aug¬ 
ment  perimeter  security  at  nuclear  plants. 


29.  See  Nuclear  Regulatory  Commission,  Fact  Sheet  on  Emergency 
Planning  and  Preparedness  at  Nuclear  Power  Plants  (November 
2004),  available  at  www.nrc.gov/reading-rm/doc-collections/fact- 
sheets/emer-plan-prep-pwr-plants.html. 

30.  General  Accounting  Office,  Nuclear  Regulatory  Commission:  Over¬ 
sight  of  Security  at  Commercial  Nuclear  Power  Plants  Needs  to  Be 
Strengthened,  GAO-03-752  (September  2003). 
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The  Nuclear  Waste  Fund  and  Yucca  Mountain 

The  safe  disposal  of  spent  nuclear  fuel  and  other  high- 
level  wastes  from  nuclear  power  activities  requires  isola¬ 
tion  of  that  material  in  perpetuity  at  secure  sites  distant 
from  population  centers  and  commercially  valuable  prop- 
erty.^^  As  far  back  as  1957,  the  National  Academy  of  Sci¬ 
ences  suggested  that  the  best  way  to  protect  the  environ¬ 
ment  and  public  health  and  safety  would  be  to  store  that 
waste  in  geologically  stable  rock  formations  deep  under¬ 
ground.  In  1982,  the  Nuclear  Waste  Policy  Act  estab¬ 
lished  legislative  authority  to  construct  such  a  long-term 
disposal  facility.  And  in  1987  amendments  to  that  law, 
the  Congress  directed  DOE  to  concentrate  on  the  Yucca 
Mountain  region — near  Las  Vegas,  Nevada — as  the  only 
site  to  consider  for  waste  disposal.  Controversy  continues 
to  surround  the  Yucca  Mountain  site  and  the  safety  of 
transporting  spent  fuel  to  Nevada.  Thus,  despite  support 
from  the  current  Administration,  completion  of  the  stor¬ 
age  facility  is  not  certain. 

Current  DOE  plans  call  for  the  site  to  accept  its  first 
shipments  of  waste  in  2010.  Given  the  planned  capacity 
of  the  site  (established  in  legislation)  to  hold  70,000  met¬ 
ric  tons,  it  is  likely  that  the  amount  of  commercial  spent 
fuel  on  hand  by  that  date  will  exhaust  the  space  allotted 
to  it.  (Electric  utilities  added  about  10,000  metric  tons  in 
just  four  years  to  reach  their  2002  on-site  storage  of 
47,000  metric  tons.)  Even  if  the  current  plans  are  success¬ 
ful,  a  second  repository — not  yet  planned  and  requiring 
additional  decades  to  construct — would  be  needed  to  ser¬ 
vice  continuing  commercial  generation. 

Price-Anderson  Indemnification  and  Liability  Limits 

The  Price-Anderson  Act,  a  1 957  amendment  to  the 
Atomic  Energy  Act  of  1954,  provides  financial  support 
for  the  nuclear  power  industry  by  creating  an  insurance 
pool  with  compensation  limits  that  are  greater  than  what 
would  otherwise  be  available  through  commercial  insur¬ 
ance.  In  addition,  that  law  limits  the  total  liability  of  an 
individual  nuclear  operator  and  of  the  industry.  The  law 
was  also  intended  to  help  victims  of  a  catastrophic  nu¬ 
clear  accident  by  potentially  making  more  resources  avail¬ 
able  to  settle  claims  than  might  otherwise  exist  and  by 
simplifying  the  legal  process  of  bringing  claims  against 
the  industry.  Without  Price-Anderson,  electric  utilities 
would  most  likely  have  had  difficulty  raising  the  capital 


31.  See  Congressional  Research  Service,  Civilian  Nuclear  Waste  Dis¬ 
posal,  CRS  Issue  Brief  IB92059  (updated  August  31,  2004). 


to  build  the  nuclear  power  plants  in  operation  today  or 
perhaps  even  continuing  operations  at  current  levels. 

The  law  requires  nuclear  plant  operators  (specifically, 
whoever  holds  an  NRC  license)  to  carry  the  maximum 
amount  of  commercial  insurance  that  is  available  (cur¬ 
rently  $300  million). But  it  also  requires  all  operators 
to  commit  to  providing  additional  resources  (currently 
up  to  about  $  1 00  million  per  reactor,  to  be  paid  out  over 
time)  to  help  any  one  operator  settle  claims.  That  second¬ 
ary  insurance  pool  includes  firms  involved  in  nuclear  fuel 
production,  shipment,  and  storage,  as  well  as  DOE  con¬ 
tractors  who  operate  government  nuclear  facilities. 

Contributions  from  Price-Anderson  pool  members 
would  be  available  and  legal  proceedings  would  be  re¬ 
stricted  in  the  event  of  what  the  act  calls  an  “extraordi¬ 
nary  nuclear  occurrence”  (or  ENO).  An  ENO  is  any 
event  that  causes  a  release  of  radioactive  material  beyond 
the  plant  site  that  the  Nuclear  Regulatory  Commission 
(or  DOE,  for  its  contractor  facilities)  determines  to  be 
substantial  and  likely  to  result  in  substantial  damages  to 
people  or  property  off-site. 

If  the  NRC  makes  a  finding  that  a  release  constitutes  an 
ENO,  operators  indemnified  under  the  Price-Anderson 
Act  waive  certain  legal  defenses,  relieving  the  claimant  of 
having  to  prove  a  defendant’s  negligence  and  of  having  to 
disprove  such  defenses  as  contributory  negligence.  Claim¬ 
ants  need  only  demonstrate  personal  injury  or  property 
damage,  the  value  of  that  loss,  and  the  causal  link  be¬ 
tween  their  loss  and  the  release  of  radioactive  material. 
Claimants  need  not  establish  the  fault  of  any  party  to  pre¬ 
vail  in  their  claims — the  law  essentially  provides  “no 


32.  For  further  discussion  of  Price-Anderson,  see  Congressional 
Research  Service,  Nuclear  Energy  Policy  (updated  October  26, 
2004);  American  Nuclear  Society,  The  Price-Anderson  Act:  Position 
Statement  54  (revised  March  2003),  available  at  www.ans.org/pi/ 
ps/docs/ps54.pdf;  and  David  S.  Ziegler,  Report  on  the  Price-Ander¬ 
son  Act  and  Its  Potential  Ejfects  on  Eureka  County,  Nevada  (prepared 
for  the  Board  of  Eureka  County  Commissioners,  March  10, 
2003),  available  at  www.yuccamountain.org/price003.htm. 

33.  42  U.S.C.  20l4(j).  A  discussion  of  factors  considered  in  making 
that  determination  and  how  they  have  changed  appears  in  Nuclear 
Regulatory  Commission,  Rulemaking  Issue  Notation  Vote,  With¬ 
drawal  of  Proposed  Rule  and  Denial  of  Petition  for  Rulemaking  Sub¬ 
mitted  by  the  Public  Citizen  Litigation  Group  and  the  Critical  Mass 
Energy  Project  (Wits  No.  W8100014),  SECY-00-0160  (July  26, 
2000),  available  at  www.nrc.gov/reading-rm/doc-collections/com- 
mission/ secys/ 2000/ secy2000-0 160/2000-01 60scy.html. 
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fault”  insurance.  Under  that  law,  the  plant  operator  alone 
is  liable  for  any  damages.  That  feature  is  intended  to  sim¬ 
plify  the  process  of  making  claims  against  the  industry — 
plaintiffs  can  make  all  of  their  claims  against  just  one  de¬ 
fendant  in  just  one  court.  Individuals  affected  by  an 
ENO  may  make  a  personal-injury  claim  within  three 
years  of  discovering  an  injury,  such  as  cancer,  regardless  of 
how  long  it  has  been  since  the  incident.  However,  those 
benefits  depend  on  the  NRC’s  declaring  an  ENO — 
which,  for  example,  it  did  not  do  after  the  accident  at 
Three  Mile  Island. 

With  1 04  commercial  nuclear  reactors  contributing 
about  $100  million  each  to  the  industry  insurance  pool, 
the  maximum  liability  of  any  single  operator  for  any  sin¬ 
gle  incident  today  would  be  about  $10.6  billion. Pre¬ 
sumably,  parties  harmed  by  a  nuclear  accident  or  attack 
also  would  be  eligible  for  federal  disaster  relief,  including 
any  emergency  funds  that  the  Congress  might  elect  to  ap¬ 
propriate  for  losses  that  exceeded  $10.6  billion.  Commer¬ 
cial  insurance  is  the  primary  insurance  for  power  plants, 
and  to  date,  no  claims  have  been  paid  from  the  secondary 
Price -Anderson  pool. 

Further  federal  assistance  could  be  available  under  two 
other  laws.  The  first  is  the  Robert  T.  Stafford  Disaster  Re¬ 
lief  and  Emergency  Assistance  Act,  which  would  com¬ 
pensate  state  and  local  governments  for  up  to  75  percent 
of  their  efforts  to  provide  early  assistance  to  victims  of  ac¬ 
cidents  that  the  President  declared  to  be  an  emergency  or 
major  disaster.^^  The  other  is  the  Terrorism  Risk  Insur¬ 
ance  Act  of  2002  (TRIA).  The  TRIA  program,  which  is 
scheduled  to  lapse  at  the  end  of  2005,  is  designed  to  re¬ 
imburse  insurers,  including  federally  approved  insurers 
such  as  those  in  the  Price-Anderson  indemnity  program, 
for  a  significant  portion  of  their  terrorism  claims. 

Ideas  for  New  Approaches 
to  Nuclear  Power  Security 

Nuclear  power  plants  may  be  relatively  attractive  as  ter¬ 
rorist  targets  because  of  the  potential  for  mass  casualties 
and  long-term  environmental  damage.  Civilian  reactor 


34.  The  actual  cost  to  the  industry  would  be  less  than  $10.6  billion  in 
present-value  terms  because  it  would  be  paid  out  over  time. 

35.  For  a  description  of  that  program,  see  Federal  Emergency  Man¬ 
agement  Agency,  Response  and  Recovery,  at  www.fema.gov/rrr/. 

36.  Federal  Register,  vol.  68,  no.  40  (February  28,  2003),  p.  9807. 


cores  were  not  designed  to  protect  against  the  type  of  at¬ 
tacks  that  are  now  of  such  concern.  Moreover,  spent  nu¬ 
clear  fuel  stored  by  electric  power  producers  remains  vul¬ 
nerable  unless  the  security  of  that  on-site  storage  can  be 
improved  or  the  material  can  be  safely  moved  to  a  secure 
central  facility,  such  as  the  one  being  constructed  at  Yucca 
Mountain.  Despite  the  many  efforts  by  nuclear  plants 
since  September  11,  emergency  preparedness  that  would 
help  to  contain  losses  may  not  fully  reflect  the  realities  of 
the  current  terrorist  threat.  A  range  of  options  exists  that 
could  increase  the  nuclear  industry’s  liability  for  the  costs 
of  preventing  or  paying  for  an  attack,  give  the  govern¬ 
ment  greater  responsibility  for  reducing  those  vulnerabili¬ 
ties  and  losses,  and  correct  problems  with  incomplete  in¬ 
formation  that  could  help  improve  decisionmaking  about 
security. 

Since  September  11 ,  all  of  the  parties  involved  in  the  nu¬ 
clear  power  industry  have  recognized  a  need  to  reassess 
security.  On  the  regulatory  front,  an  NRC  official  testi¬ 
fied  before  the  Congress  in  early  2003  that  the  agency  has 
issued  orders  requiring  “increases  in  security  staffing, 
posts,  and  patrols  [and]  installation  of  substantial  physi¬ 
cal  barriers.  The  same  testimony  highlighted  the 
NRC’s  efforts,  in  coordination  with  the  Department  of 
Homeland  Security,  to  devise  realistic  attack  scenarios 
and  responses.  It  also  cited  ongoing  studies  of  the  vulner¬ 
ability  of  reactor  cores  and  on-site  storage  of  spent  mate¬ 
rials  to  attacks  by  air. 

Many  of  the  options  that  the  Congress  might  choose  to 
implement  would  be  likely  to  build  on  actions  already 
under  way  or  being  examined.  The  Government  Ac¬ 
countability  Office  has  reviewed  the  many  recommenda¬ 
tions  from  commissions  created  by  the  Congress  and  has 
provided  its  own  analyses  of  some  specific  concerns  about 
nuclear  security.^^  The  National  Research  Council  also 
has  reported  recommendations  for  addressing  nuclear 


37.  Statement  of  Hubert  Miller,  Regional  Administrator,  Region  I, 
Nuclear  Regulatory  Commission,  before  the  Subcommittee  on 
National  Security,  Emerging  Threats,  and  International  Relations 
of  the  House  Committee  on  Government  Affairs,  March  10, 
2003. 

38.  General  Accounting  Office,  Flomeland  Security:  Selected  Recom¬ 
mendations  from  Congressionally  Chartered  Commissions  and  GAO, 
GAO-04-591  (March  2004),  Nuclear  Regulatory  Commission: 
Oversight  of  Security  at  Commercial  Nuclear  Power  Plants  Needs  to 
Be  Strengthened,  and  Spent  Nuclear  Fuel:  Options  Exist  to  Further 
Enhance  Security,  GAO-03-426  (July  2003). 
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and  radiological  threats  and  recently  released  a  classified 
report  related  to  the  specific  threat  from  spent  fuel.^^  Ri¬ 
chard  Meserve,  former  Chairman  of  the  Nuclear  Regula¬ 
tory  Commission,  has  offered  further  suggestions.'^*' 

Homeland  security  is  just  one  of  several  considerations 
that  drive  national  policy  on  civilian  nuclear  power.  Ad¬ 
vocates  of  federal  programs  to  support  nuclear  energy  cite 
many  positive  attributes  of  nuclear  power  generation  for 
the  nation’s  energy  supply  and  environment  (such  as  an 
absence  of  emissions  associated  with  global  warming,  acid 
rain,  and  ambient  ozone,  as  well  as  the  haze  that  can 
come  from  coal-fired  generation).  Policies  that  would 
have  the  effect  of  restricting  nuclear  power  activities  to 
promote  increased  security  would  need  to  be  balanced 
with  those  other  considerations. 

Internalizing  the  Costs  of  Nuclear  Security 

Any  accident  or  attack  involving  nuclear  power  presents 
risks  to  health  and  the  environment  well  into  the  future, 
and  the  losses  from  a  large  release  of  radioactive  material 
at  a  nuclear  power  plant  would  far  exceed  the  value  of  the 
electricity  such  a  facility  would  generate.  In  creating  the 
NRC,  the  Congress  recognized  that  low  private  costs 
mean  the  industry  would  have  greater  incentive  to  pro¬ 
duce  nuclear  power  and  less  incentive  to  invest  in  plant 
security  than  may  be  optimal  for  society  as  a  whole.  A 
number  of  options  exist  that  could  help  address  that  con¬ 
tinuing  concern  by  internalizing  the  costs  of  potential  at¬ 
tacks  within  the  industry. 

One  approach  would  be  to  increase  the  share  of  the  costs 
to  nuclear  power  operators  and  investors  in  the  case  of  a 
severe  incident,  or  to  make  those  costs  more  apparent  to 
the  neighbors  of  nuclear  power  plants.  That  would  add 
private  incentives  to  take  security  precautions  or  perhaps 
just  to  operate  the  number  of  nuclear  power  plants  that 


39.  Concerning  radiological  threats,  see  National  Research  Council, 
Making  the  Nation  Safer.  Concerning  spent  fuel,  see  background 
and  meetings  of  the  National  Research  Council,  Board  on  Radio¬ 
active  Waste  Management,  Committee  on  Safety  and  Security  of 
Spent  Nuclear  Fuel  Storage,  available  at  dels.nas.edu/sfs/presenta- 
tions.html. 

40.  Richard  A.  Meserve,  “Nuclear  Security:  Challenges  for  Today  and 
Tomorrow”  (presentation  at  the  conference  “Future  of  Nuclear 
Energy  in  Wisconsin,”  Madison,  Wisconsin,  October  2003), 
available  at  www.engr.wisc.edu/ep/conference_papers/NuclrConf- 
Security5.pdf 


would  be  most  consistent  with  the  relative  benefits  and 
costs  of  nuclear  energy. 

Other  options  more  generally  would  mandate  changes  in 
industry  practices  to  improve  the  security  of  power  reac¬ 
tors  and  spent  fuel  against  ground  and  air  assaults.  Those 
options  include: 

■  Requiring  utilities  to  increase  the  physical  security  of 
reactor  cores  against  both  ground  and  air  assaults  (for 
example,  by  employing  security  forces  that  could  resist 
a  more  significant  armed  attack  or  by  adding  physical 
features  that  would  better  shield  containment  struc¬ 
tures  against  attacks  by  heavy  arms  or  by  aircraft  than 
is  now  the  case). 

■  Requiring  utilities  to  construct  safer  interim  storage 
facilities  for  spent  nuclear  materials  (for  example,  by 
increasing  the  physical  security  of  storage  areas  or  the 
use  of  dry-cask  storage). 

■  Establishing  requirements  for  safer  transport  casks  or, 
alternatively,  establishing  safer  transportation  routes 
that  nuclear  fuel  and  spent  fuel  should  follow.  Safer 
routes  might  involve  constructing  new  rail  lines  to 
avoid  city  centers. 

■  Establishing  enhanced  incentives  and  protections  for 
reporting  on  unsafe  practices  and  security  breaches. 

Concerning  improved  security  against  ground  assaults, 
two  months  after  the  September  1 1  attacks,  the  NRC 
proposed  that  private  guards  at  nuclear  plants  be  permit¬ 
ted  to  use  deadly  force  in  a  wider  array  of  circumstances 
and  be  given  better  armament.  (Federal  law  now  pre¬ 
cludes  the  use  of  automatic  weapons  by  guards  at  civilian 
nuclear  power  plants.)  It  also  proposed  that  federal  au¬ 
thority  supersede  state  laws  that  would  otherwise  restrict 
private  guards  from  using  deadly  force  or  certain  weap¬ 
ons.^'  Those  proposals  have  not  yet  been  acted  on. 

Other  options  that  would  have  the  effect  of  forcing  in¬ 
dustry  to  internalize  the  expected  costs  of  a  terrorist  at¬ 
tack  relate  to  changes  in  the  Price-Anderson  Act.  Insur¬ 
ance  coverage  under  that  program  may  be  too  low 
because  it  does  not  consider  a  worst-case  attack  or  attacks 


41.  General  Accounting  Office,  Nuclear  Regulatory  Commission:  Over¬ 
sight  of  Security  at  Commercial  Nuclear  Plants  Needs  to  Be  Strength¬ 
ened,  pp.  20-21. 
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on  multiple  targets.  Such  considerations  suggest  options 
that  include: 

■  Increasing  insurance  coverage  to  reflect  the  full  costs 
of  a  nuclear  disaster — for  example,  by  raising  the  max¬ 
imum  liability  per  licensed  reactor  in  the  Price-Ander- 
son  pool  or  requiring  plant  operators  to  purchase  (and 
commercial  insurers  to  offer)  additional  coverage. 
There  could  be  a  requirement  for  individuals  and 
businesses  residing  in  emergency  zones  to  carry  their 
own  nuclear  incident  coverage  (and  for  commercial 
insurers  to  offer  that  coverage). 

■  Revising  the  Price-Anderson  Act’s  indemnity  so  that 
more  of  any  payout  would  come  from  the  investors  in 
those  utilities  rather  than  from  the  rate  payers. 

■  Placing  authority  for  determining  an  extraordinary 
nuclear  occurrence — the  prerequisite  for  activating  the 
expedited  judicial  process  under  Price-Anderson — 
with  the  courts  or  some  other  agency  or  establishing 
explicit  criteria  in  legislation  for  the  Nuclear  Regula¬ 
tory  Commission  to  determine  an  ENO.  Such  action 
could  raise  the  industry’s  financial  exposure  and  in¬ 
crease  the  likelihood  of  a  payout  from  the  Price- 
Anderson  pool. 

Socializing  the  Costs  of  Nuclear  Security 

Many  nuclear  security  enhancements  could  instead  be 
addressed  by  having  the  government  take  over  or  pay  for 
those  activities.  Some  options  that  would  socialize  the 
costs  of  nuclear  attacks  include: 

■  Establishing  fiscal  incentives  for  utilities  to  construct 
safer  interim  storage  (for  example,  tax  credits  for 
spending  on  dry-cask  storage  or  stronger  structures  for 
wet  storage). 

■  Establishing  fiscal  incentives  for  studying  and,  if  feasi¬ 
ble,  adopting  inherently  safer  reactor  designs  and  safer 
containment  structures. 

■  Providing  financial  assistance  to  people  and  businesses 
to  move  away  from  nuclear  sites. 

If  the  federal  government  has  a  strong  cost  advantage 
over  the  private  sector  in  performing  certain  security  ac¬ 
tivities,  federalizing  those  activities  may  be  cost-effective. 
One  activity  that  the  government  is  already  addressing  is 
the  disposal  of  high-level  radioactive  wastes  through  the 


development  of  the  Yucca  Mountain  disposal  site,  funded 
in  part  by  fees  on  utilities.  However,  completion  of  that 
site  is  not  yet  certain.  The  federal  government  may  also 
have  some  advantages  over  private  firms  in  directly  pro¬ 
viding  physical  security.  For  example,  many  people  be¬ 
lieve  that  the  authority  to  use  deadly  force  and  to  use  cer¬ 
tain  high-powered  weapons  should  reside  with  a 
government  entity.  Some  options  reflecting  that  position 
include: 


■  Federalizing  and  expanding  the  current  level  of  perim¬ 
eter  security,  structural  defenses,  and  employee  screen¬ 
ing  to  help  protect  nuclear  power  plants  and  the  spent 
material  stored  there. 

■  Constructing  a  secure,  central  disposal  site  for  spent 
fuel,  such  as  Yucca  Mountain — and  possibly  expand¬ 
ing  storage  capacity  beyond  current  plans  to  accom¬ 
modate  the  additional  wastes  that  are  likely  to 
accumulate  in  the  next  few  years.  The  threat  of  terror¬ 
ism  increases  the  benefits  of  completing  a  central  site 
to  lower  the  risk  of  an  attack  on  the  spent  fuel  now 
stored  at  plants  across  the  country. 

■  Subsidizing  the  construction  of  safer  transport  casks 
and  safer  transportation  routes  that  the  spent  fuel 
should  follow.  The  latter  could  involve  subsidizing  the 
construction  of  new  rail  lines  to  avoid  city  centers. 


Since  the  attacks  of  September  1 1 ,  the  Congress  has  con¬ 
sidered  a  number  of  measures  that  would  create  a  federal 
force  dedicated  to  securing  nuclear  plants  or  taking  ac¬ 
tion  if  an  attack  occurred.  For  example,  the  Congres¬ 
sional  Research  Service  notes  that  the  proposed  Nuclear 
Security  Act  of  200 1  would  have  created  a  federal  security 
force  to  replace  the  private  security  guards  now  in  place  at 
nuclear  plants. Another  legislative  proposal,  the  Nu¬ 
clear  Security  Act  of  2002,  would  have  stopped  short  of 
replacing  the  security  forces  already  guarding  nuclear 
plants  but  would  have  augmented  those  forces  with  fed¬ 
eral  personnel  and  National  Guard  troops. Among 
other  things,  that  bill  would  have  created  new  rules  on 
security  compliance  at  nuclear  facilities  and  a  program  to 
classify,  track,  and  monitor  radioactive  sources  through¬ 
out  the  country.  On  the  basis  of  information  from  the 
Nuclear  Regulatory  Commission,  the  Congressional 


42.  H.R.  3382,  I07th  Cong.  (2001). 

43.  S.I746,  I07th  Cong.  (2002). 
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Budget  Office  (CBO)  estimated  that  implementing  the 
Nuclear  Security  Act  of  2002  would  have  had  a  gross  cost 
of  $486  million  over  the  2003-2007  period.  However, 
the  NRC  has  the  authority  to  offset  a  substantial  portion 
of  its  annual  appropriation  with  fees  charged  to  the  facili¬ 
ties  it  regulates.  Accounting  for  such  collections,  CBO  es¬ 
timated  that  implementation  would  have  resulted  in  a  net 
federal  cost  of  $126  million  over  that  period,  assuming 
appropriation  of  the  necessary  amounts. 

Improving  Information 

If  the  owners  of  nuclear  power  plants  underestimate  the 
likelihood  of  a  terrorist  attack  on  their  facilities  or  under¬ 
estimate  the  loss — even  their  own  direct  loss — from  such 
an  incident,  they  may  be  inclined  to  operate  more  nuclear 
power  plants  or  utilize  more  of  their  existing  capacity 
than  is  consistent  with  homeland  security.  They  may  also 
not  spend  enough  on  safety  at  those  plants.  Similarly, 
many  people  will  reside  too  close  to  a  nuclear  plant  if 


44.  See  Congressional  Budget  Office,  Cost  Estimate  for  S.  1746, 
Nuclear  Security  Act  of 2002  (October  25,  2002). 


they  misgauge  the  risks  and  costs  of  an  incident.  The  task 
of  recognizing  personal  risk  is  especially  difficult  because 
many  of  the  health  effects  of  radiation  exposure  can  be 
delayed  for  decades  and  because  the  effects  vary  among 
individuals.  Contamination  and  exposure  may  continue 
for  decades.  Some  policy  options  that  could  help  improve 
information  include: 

■  Providing  better  information  to  the  public  on  the 
safety  record  of  individual  nuclear  plants. 

■  Expanding  NRC  emergency  zones  to  reflect  worst- 
case  events,  tailored  to  individual  plants. 

■  Preparing  individual  vulnerability  assessments  for 
localities  that  would  reflect  the  danger  from  spent  fuel 
as  well  as  from  the  reactor  core. 

■  Establishing  national  property  zoning  (like  FEMA 
flood  zones)  to  inform  new-home  purchasers  and 
businesses  of  the  zone  designation. 
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Chemicals  and  Hazardous  Materials 


security  of  the  chemical  industry — which  in¬ 
cludes  oil  and  gas  production,  processing,  and  transporta¬ 
tion — was  a  concern  before  September  11,  but  after  that 
date,  the  increased  national  threat  of  terrorism  amplified 
the  expected  losses  for  individual  chemical  facilities  and 
transport  systems  that  many  people  already  deemed  vul¬ 
nerable.  No  information  suggests  that  the  relative  attrac¬ 
tiveness  of  attacks  on  the  chemical  industry  has  increased, 
although  September  1 1  did  indicate  that  the  scope  of  po¬ 
tential  attacks  is  now  larger.  In  addition,  certain  types  of 
attacks,  such  as  those  using  fuel  oil  and  nitrates  to  fashion 
weapons  for  use  elsewhere,  may  be  more  likely  now  than 
before. 

Vulnerabilities  from  Processes, 
Transportation,  and  Misuse 
of  Materials 

Ensuring  the  security  of  the  chemical  industry  is  impor¬ 
tant  primarily  because  of  the  special  dangers  that  flamma¬ 
ble  and  toxic  substances  can  pose,  including  immediate 
explosion  and  fire,  release  into  the  air  or  water,  or  theft 
(and  subsequent  use  in  attacks  elsewhere).^  The  major 
groups  of  chemical  products  include  basic  industrial 
chemicals,  plastics  and  rubbers,  drugs,  detergents,  paints, 
and  agricultural  chemicals.  However,  only  a  small  subset 
of  the  many  thousands  of  chemicals  produced  and  con¬ 
sumed  in  the  United  States  are  of  concern  for  homeland 
security. 

Extremely  Hazardous  Chemicals 

The  Environmental  Protection  Agency — the  primary 
federal  agency  tasked  with  protecting  the  public  and  the 
environment  from  chemical  accidents — lists  more  than 


1.  Linda-Jo  Schierow,  Chemical  Plant  Security,  CRS  Report  for  Con¬ 
gress  RL31530  (Congressional  Research  Service,  updated  October 
22,  2004). 


300  chemicals  as  “extremely  hazardous.”^  Focusing  on 
those  chemicals  that  could  harm  people  after  exposure  for 
only  a  short  time,  the  agency  closely  monitors  chemical 
facilities  with  the  capacity  to  process  amounts  in  excess  of 
threshold  quantities  from  a  list  of  77  acutely  toxic  chemi¬ 
cals  and  63  flammable  gases  and  liquids.^  Even  on  that 
shorter  list,  just  13  substances  or  mixtures  account  for 
more  than  90  percent  of  the  total  mass  (by  weight)  of 
hazardous  materials. 

The  most  hazardous  chemical  substances  come  largely 
from  three  segments  of  the  industry; 

■  Petrochemicals  (organic  industrial  chemicals), 

■  Nitrates  (agricultural  chemicals),  and 

■  Ammonia  and  chlorine  (inorganic  industrial 
chemicals). 

Petrochemicals — such  as  fuels,  solvents,  and  raw  materi¬ 
als  to  make  plastics — are  of  concern  not  only  because 


2.  That  list  is  compiled  as  part  of  section  302  of  the  Emergency 
Planning  and  Community  Right-to-Know  Act.  Information  on 
the  complete  list  and  descriptions  of  chemicals  described  as 
extremely  hazardous  are  available  at  yosemite.epa.gov/oswer/ 
ceppoweb.nsf/content/ehs_2003.htm?openDocument. 

3.  See  James  C.  Belke,  “Chemical  Accident  Risks  in  U.S.  Industry — 
A  Preliminary  Analysis  of  Accident  Risk  Data  from  U.S.  Hazard¬ 
ous  Chemical  Facilities,”  Proceedings  of  the  10th  International  Sym¬ 
posium  on  Loss  Prevention  and  Safety  Promotion  in  the  Process 
Industries,  Stockholm,  Sweden  (Amsterdam:  Elsevier  Science, 

2001),  copy  available  at  www.epa.gov/swercepp/pubs/stockholm- 
paper.pdf  Threshold  quantities  for  toxic  substances  range  from 
500  pounds  to  20,000  pounds.  For  all  listed  flammable  sub¬ 
stances,  the  threshold  quantity  is  10,000  pounds.  For  explosive 
substances,  the  threshold  quantity  is  5,000  pounds.  See  Environ¬ 
mental  Protection  Agency,  List  of  Regulated  Substances  and  Thresh¬ 
olds  for  Accidental  Release  Prevention,  40  C.F.R.  9,  available  at 
www.epa.gov/swercepp/rules/listrule.html. 
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they  are  highly  flammable  but  also  because  they  are  found 
at  very  large  and  complex  facilities,  often  in  close  proxim¬ 
ity  to  one  another.  Thus,  the  immediate  dangers  from  an 
attack  and  the  resulting  economic  disruption  would  be 
greater  than  otherwise.  In  sufficient  concentrations,  the 
atmospheric  release  of  many  of  those  substances  (by  fire 
or  spills)  could  also  be  immediately  toxic  or,  over  time,  be 
associated  with  cancer  and  other  health  problems  or  with 
environmental  damage. 

Nitrates,  produced  from  ammonia  or  urea,  include  a  vari¬ 
ety  of  nitrogen-based  compounds  used  to  make  fertilizers, 
pesticides,  and  explosives,  and  they  are  highly  flammable. 
Nitrate-fertilizer  plants  themselves  could  be  targets  for  at¬ 
tack,  but  the  fertilizers  stored  at  thousands  of  warehouses 
across  the  country  (accounting  for  the  largest  number  of 
sites  that  EPA  monitors)  are  perhaps  of  greater  concern 
for  homeland  security,  primarily  because  of  the  difficulty 
in  securing  fertilizers  against  misuse.  The  sale  of  ammo¬ 
nium  nitrate  fertilizer  is  legal.  However,  retail  outlets 
could  be  vulnerable  as  targets  for  diversion  of  fertilizers 
by  terrorists,  and  weakly  guarded  storage  facilities  could 
be  targets  for  theft.  Ammonium  nitrate  combined  with 
diesel  oil  was  used  as  the  explosive  in  the  World  Trade 
Center  bombing  in  1993  and  the  Oklahoma  City  bomb¬ 
ing  in  1995. 

Some  toxic  substances — especially  ammonia  and  chlo¬ 
rine — are  a  homeland  security  concern  in  large  part  be¬ 
cause  of  their  preponderance  and,  hence,  their  accessibil¬ 
ity.  They  can  be  very  poisonous  if  released  into  the  air  or 
water  in  high  concentrations.  Ammonia  is  present  in  one- 
third  of  the  facilities  handling  at  least  threshold  volumes 
of  hazardous  material  and  in  more  than  half  of  the  facili¬ 
ties  handling  toxic  substances.  (At  those  facilities,  the  vol¬ 
ume  of  anhydrous  ammonia  is  of  greatest  concern;  the 
threat  from  aqueous  ammonia,  which  is  common  in 
household  cleaners,  is  much  less  significant.)  The  major 
use  of  ammonia  and  its  compounds  is  as  fertilizers.  Rela¬ 
tively  smaller  amounts  of  ammonia  solutions  also  are 
present  in  thousands  of  cold-storage  facilities,  where  they 
are  used  as  refrigeration  coolants.  Other  uses  include 
cleaning;  making  soap;  bleaching  (and  processing  paper); 
etching  aluminum  products;  and  manufacturing  other 
chemicals,  drugs,  and  plastics. 

Chlorine,  too,  is  widely  present.  It  is  used  in  purifying 
water  in  communities  across  the  country  as  well  as  in  pro¬ 
ducing  vinyl  plastics  and  making  many  medicines.  Con¬ 
cern  over  chlorine  stems  from  both  its  storage  at  facilities 


and  its  transportation  in  rail  tank  cars.  A  related  concern 
is  the  flammability  of  hydrogen,  a  byproduct  in  the  ex¬ 
traction  of  chlorine  from  salt  water. 

Monitoring  Facilities  Through  EPA’s 
Risk  Management  Program 

Concerns  about  hazardous  chemicals — whether  flamma¬ 
ble  or  toxic — relate  to  both  the  suppliers  and  the  users  of 
those  chemicals,  including  those  who  transport  and  store 
such  materials.  On  the  basis  of  data  provided  by  busi¬ 
nesses  to  EPAs  Risk  Management  Program,  EPA  reported 
in  2000  that  nearly  15,000  facilities  were  handling  at 
least  one  hazardous  substance  in  a  quantity  greater  than 
threshold  limits.  Those  facilities  themselves  represent  a 
subset  of  a  much  larger  number  of  businesses  handling  a 
“significant”  quantity. 

EPAs  Risk  Management  Program  monitors  large  chemi¬ 
cal  producers,  including  petroleum  refiners,  petrochemi¬ 
cal  manufacturers,  and  nitrate-fertilizer  manufacturers.  It 
also  monitors  many  small  facilities  involved  with  fertilizer 
storage,  refrigerated  storage,  and  water  treatment.  The 
greatest  number  of  chemical  processes  that  EPA  tracks  in¬ 
volve  just  two  toxic  substances:  ammonia  and  chlorine. 
Relatively  few  chemical  processes,  other  than  production 
of  nitrate  fertilizers,  involve  flammable  substances.  How¬ 
ever,  because  the  facilities  that  handle  many  flammable 
substances — petroleum  refineries,  petrochemical  plants, 
natural  gas  plants,  wholesale-fuel  terminals,  and  propane 
distribution  centers — have  such  large  capacities,  the 
greatest  volume  of  hazardous  chemicals  that  EPA  regu¬ 
lates  are  flammable. 

In  addition  to  the  facilities  monitored  by  the  Risk  Man¬ 
agement  Program,  numerous  facilities  with  smaller  quan¬ 
tities  of  such  chemicals  can  raise  homeland  security  con¬ 
cerns.  In  particular,  the  15,000  facilities  in  the  program 
exclude  retail  outlets  for  flammable  chemicals  used  as 
fuel,  such  as  gasoline  stations  and  retail  propane  distribu¬ 
tors,  which  are  not  required  to  report  to  EPA.  The  many 
smaller  suppliers,  transporters,  and  consumers  of  those 
chemicals  may  hold  sufficient  quantities  of  dangerous 
materials  to  cause  harm  if  the  materials  were  released  or 
set  on  fire.  They  may  also  have  the  information  or  equip¬ 
ment  necessary  to  make  more-dangerous  substances.  Fur¬ 
ther,  because  those  smaller  potential  targets  are  especially 
dispersed  and  potentially  more  difficult  to  defend,  they 
may  be  attractive  as  terrorist  targets. 
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Potential  Losses  from  Explosions 
and  Toxic  Releases 

Indications  of  the  possible  costs  of  an  attack  on  chemical 
facilities  come  from  several  sources,  including  assessments 
of  accidental-release  scenarios  prepared  for  EPA;  assess¬ 
ments  of  attack  scenarios  that  the  Department  of  Home¬ 
land  Security  (DHS)  has  recently  been  preparing  on  its 
own;  and  information  about  the  human,  environmental, 
and  economic  losses  from  previous  major  accidents  in¬ 
volving  chemicals.  As  distinct  from  the  immediate  eco¬ 
nomic  costs  to  targeted  facilities  (and,  possibly,  associated 
businesses  and  nearby  communities),  economic  costs  to 
the  nation  as  a  whole  from  an  attack  would  derive  mainly 
from  any  disruption  of  current  supply  to  the  businesses 
and  consumers  that  purchase  the  output  of  the  targeted 
facilities  and  from  any  loss  of  productive  facilities  (and 
future  supply). 

EPA’s  Accidental  Release  Scenarios 

Chemical-facility  operators  covered  by  EPAs  Risk  Man¬ 
agement  Program  must  submit  analyses,  referred  to  as 
offsite  consequence  analyses,  of  the  possible  consequences 
of  hypothetical  worst-case  release  and  alternative-release 
scenarios  for  the  most  hazardous  substance  present. 
(Those  analyses  are  separate  from  the  five-year  histories  of 
accidents  that  those  businesses  must  also  report.)  Al¬ 
though  the  scenarios  are  intended  as  a  source  of  informa¬ 
tion  on  potential  accidents,  they  also  can  provide  insights 
into  the  numbers  of  people  potentially  at  risk  from  an  at¬ 
tack  on  those  facilities. 

In  the  “worst-case  release”  scenarios,  operators  describe 
the  maximum  quantities  of  release  from  the  rupture  of 
the  single  largest  vessel  or  process  line  at  the  facility  and 
the  maximum  range  (or  end-point  distance)  that  a  toxic 
cloud  or  a  blast  could  reach.  (The  end-point  is  the  dis¬ 
tance  a  toxic  vapor  cloud,  heat  from  a  fire,  or  blast  wave 
from  an  explosion  could  travel  before  dissipating  to  the 
point  that  serious  injuries  from  short-term  exposures 
would  no  longer  occur.)  The  analyses  also  include  infor¬ 
mation  on  the  number  of  people  or  sensitive  sites  that 
such  a  release  could  harm.  The  results  reflect  the  popula¬ 
tion  present  in  the  full  circle  around  the  chemical  facil¬ 
ity — not  necessarily  the  number  that  would  be  harmed — 
and  are  intended  only  to  show  the  consequences  of  worst- 
case  atmospheric  conditions  with  no  measures  taken  to 
prevent  or  mitigate  a  release. 


In  contrast,  EPAs  “alternative-release”  scenarios  describe 
the  consequences  of  incidents  that  may  be  more  represen¬ 
tative  of  actual  emergencies.  In  particular,  toxic  clouds  are 
assumed  to  disperse  farther,  but  only  in  the  direction  of 
the  prevailing  winds,  and  any  losses  would  be  mitigated 
by  early-warning  systems  and  emergency  response.  For 
that  reason,  EPA  recommends  that  communities  make 
use  of  alternative-release-scenario  assessments  in  their 
emergency  planning  for  chemical  accidents. 

When  considering  a  terrorist  attack,  it  may  not  be  reason¬ 
able  to  assume  the  presence  of  mitigating  circumstances. 
For  example,  emergency  vehicles  may  not  be  able  to  reach 
the  release  site.  Or  the  attack  may  be  timed  so  that  the 
wind  is  blowing  in  the  worst  possible  direction.  There¬ 
fore,  reviewing  the  worst-case  release  data  is  also  useful. 

EPAs  worst-case  release  data  indicate  that,  in  general,  the 
distances  and  thus  the  populations  that  could  be  threat¬ 
ened  are  greater  for  toxic  substances  than  for  flammable 
substances.^  Measured  as  end-point  distances  from  the  fa¬ 
cility,  releases  of  toxic  substances  in  those  worst-case  sce¬ 
narios  encompass  1.6  miles — the  median  distance  for  all 
facilities  reporting.  For  facilities  handling  flammable  sub¬ 
stances,  the  median  distance  affected  by  a  vapor-cloud  ex¬ 
plosion  would  be  0.4  miles.  Similarly,  the  median  popu¬ 
lation  size  that  those  releases  would  affect  are  1,500 
people  for  toxic  substances  and  1 5  for  vapor-cloud  explo¬ 
sions  involving  flammable  substances. 

Those  statistics,  however,  mask  far  greater  dispersions  for 
a  significant  number  of  facilities.  Models  of  atmospheric 
dispersion  indicate  that  the  chlorine  stored  by  many  facil¬ 
ities  in  90-ton  rail  tank  cars  can  spread  as  far  as  14  miles 
in  urban  settings  and  25  miles  in  rural  settings.  Models 
provide  similar  estimates  for  the  dispersion  of  large  quan¬ 
tities  of  several  other  toxic  chemicals. 

Concerning  the  populations  at  risk,  about  8,000  facilities 
that  handle  toxic  substances  reported  worst-case  release 
scenarios  that  each  could  endanger  at  least  1,000  people. 
Those  figures  do  not  represent  deaths  or  injuries  but 


4.  Data  on  Environmental  Protection  Agency  release  scenarios  come 
from  Paul  R.  Kleindorfer  and  others,  “Accident  Epidemiology  and 
the  U.S.  Chemical  Industry:  Accident  History  and  Worst-Case 
Data  from  RMP*  Info,”  Risk  Analysis^  vol.  23,  no.  5  (2003),  pp. 
865-881,  available  at  opim.wharton.upenn.edu/risk/downloads/ 
03-24-PK.pdf;  and  from  conversations  with  James  C.  Belke  of 
EPA. 
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rather  the  numbers  residing  within  a  circle  that  encom¬ 
passes  the  facilities’  worst-case  end-point  distance.  With 
the  short  end-point  distances  for  explosions  of  flammable 
substances,  relatively  few  people  would  be  endangered  by 
such  events,  even  at  the  largest  chemical  facilities  in  the 
country.  Nearly  300  of  those  large  facilities  reported 
worst-case  release  scenarios  involving  flammable  sub¬ 
stances  that  could  affect  more  than  1,000  people,  and 
none  could  endanger  more  than  100,000. 

Department  of  Homeland  Security’s 
Release  Scenarios 

To  help  identify  the  facilities  most  at  risk  and  to  prioritize 
security  efforts,  the  Department  of  Homeland  Security 
has  been  working  with  the  EPA  model  to  prepare  its  own 
assessments  of  likely  attack  scenarios  and  consequences.^ 
The  chemical  releases  addressed  in  DHS’s  scenarios  gen¬ 
erally  pose  a  greater  danger  than  those  in  EPA’s  worst-case 
release  because  all  chemicals  at  each  facility  are  assumed 
to  be  at  risk.  However,  as  with  EPAs  alternative-release 
scenarios,  DHS  assumes  that  the  plume  of  release  only 
blows  in  one  direction  and  that  an  emergency  response  is 
able  to  further  mitigate  the  losses.  On  net,  the  number  of 
people  at  risk  is  generally  lower  in  those  DHS  scenarios 
than  in  an  EPA  worst-case  release,  but  the  threat  to  them 
is  likely  to  be  greater.  Such  an  assessment  can  be  of  value 
in  determining  how  to  prioritize  security  efforts — in  con¬ 
trast  with  the  EPA  program’s  purpose,  which  is  to  under¬ 
stand  and  prevent  accidents.  DHS  reports  that  only 
about  3,700  plants  (handling  either  toxic  or  flammable 
substances  or  both)  would  threaten  more  than  1,000  peo¬ 
ple.*^  And  only  two  plants  would  endanger  more  than  a 
million  people. 

Evidence  of  Potential  Losses  from  Past  Accidents 

Further  indication  of  the  potential  human  and  environ¬ 
mental  losses  and  economic  costs  from  an  attack  on  a 
large  chemical  facility  comes  from  major  accidents  that 
have  occurred  both  abroad  and  in  the  United  States. 
Those  events  indicate  that  the  human  and  environmental 
losses  could  be  significant. 


5.  The  Department  of  Homeland  Security  has  not  released  those 
assessments  in  any  public  documents.  A  discussion  of  its  method¬ 
ology  and  some  results — numbers  of  facilities  that  may  be  associ¬ 
ated  with  harm  to  critical  levels  of  population  if  attacked — appear 
in  Robert  Block,  “Chemical  Plants  Still  Have  Few  Terror  Con¬ 
trols,”  Wall  Street  Journal,  August  20,  2004,  p.  Bl. 

6.  Estimate  from  telephone  conversation  with  staff  of  the  Depart¬ 
ment  of  Homeland  Security. 


The  most  notable  example  of  a  chemical  accident  that 
caused  widespread  losses  is  the  1984  accidental  release  of 
a  fatal  pesticide  ingredient  in  Bhopal,  India.  By  some  esti¬ 
mates,  that  accident  killed  nearly  4,000  people  outright. 
India’s  courts  ordered  the  Union  Carbide  Corporation, 
which  owned  the  facility,  to  pay  $470  million  in  compen¬ 
sation  to  more  than  566,000  survivors  and  dependents, 
including  thousands  of  victims  who  were  permanently 
disabled.^  Bhopal  involved  the  release  of  a  single  sub¬ 
stance  from  a  single  vessel  but  under  the  worst  atmo¬ 
spheric  conditions  and  with  no  emergency  response — 
much  as  in  an  EPA  worst-case  scenario — and  was  com¬ 
pounded  by  inadequate  building  standards  and  no  effec¬ 
tive  zoning  to  limit  residential  housing  around  the  plant. 
The  greatest  loss  of  life  in  the  United  States  from  a  chem¬ 
ical  accident  came  from  the  1 947  explosion  of  a  fertilizer¬ 
laden  ship  in  Texas  City,  Texas,  which  spread  fire  to 
nearby  ships  and  to  industrial  facilities  onshore  and 
claimed  about  600  lives. ^  Because  it  involved  multiple 
substances,  the  explosion  was  more  akin  to  the  DHS  at¬ 
tack  scenarios. 


In  both  of  those  cases,  the  chemicals  involved  were  widely 
available,  so  the  costs  of  those  accidents  to  the  private  sec¬ 
tor  were  largely  confined  to  the  value  of  the  facilities  and 
product  that  were  lost  and,  in  the  Bhopal  case,  the  subse¬ 
quent  court  judgment  against  Union  Carbide. 

Recent  experience  with  chemical  accidents  in  the  United 
States  is  much  less  extreme.  Many  of  the  accidents  have 
involved  freight  derailments,  tanker  spills,  pipeline  leaks, 
or  fires  at  major  production  facilities.  The  nation  appears 
to  be  particularly  vulnerable  in  the  transportation  stage, 
as  hazardous  materials  move  by  truck  and  rail  through 
population  centers,  although  the  history  of  chemical  acci¬ 
dents  includes  very  few  events  with  a  loss  of  life  beyond  a 
facility  site. 

The  Exxon  Valdez  oil  spill  of  1989  is  an  example  of  such 
transportation  risks.  As  with  Bhopal,  it  appears  that  the 
immediate  economic  costs  of  that  spill  to  the  Exxon  Cor¬ 
poration  were  less  than  the  associated  human  and  envi- 


7.  For  a  recent  discussion,  see  Harbaksh  Singh  Nanda,  “Bhopal  Gas 
Leak  Award  20  Years  Later,”  United  Press  International,  July  21, 
2004,  available  at  washingtontimes.com/upi-breaking/2004072 1- 
104226-4298r.htm. 

8.  For  a  description  of  the  accident,  see  “The  Texas  City  Disaster, 
April  16  and  17,  1947,”  available  atwww.ezl.com/-fireball/ 
Disaster20.htm. 
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ronmental  losses,  although  the  company  subsequently 
was  held  liable  for  much  of  the  broader  loss  to  society. 
The  net  economic  costs  to  the  oil  industry  were  probably 
small.  When  the  Exxon  Valdez  ran  aground,  the  value  of 
the  240,000  barrels  of  crude  oil  spilled  (a  measure  of  the 
immediate  economic  harm)  was  only  about  $25  million. 
In  addition,  there  was  the  lost  value  of  the  tanker.  On  top 
of  those  immediate  costs,  Exxon  incurred  further  private 
costs  to  compensate  for  the  damage  that  it  caused.  The 
company  reportedly  paid  more  than  $2  billion  for 
cleanup  activities,  as  well  as  about  $1  billion  in  criminal 
restitution  and  civil  penalties — much  of  which  went  to 
pay  for  further  cleanup,  restoration,  and  compensation 
(largely  through  purchasing  land  that  would  be  perma¬ 
nently  protected  as  wildlife  habitat,  parks,  and  refuges).^ 

Economic  Costs  to  the  Nation 
Versus  Immediate  Costs  to  the  Owner 

In  previous  major  accidents  involving  chemicals,  it  ap¬ 
pears  that  the  economic  costs  to  the  whole  nation  in 
question  were  even  smaller  than  the  immediate  costs  to 
the  owners  from  the  loss  of  production  facilities  and  sales. 
The  national  cost  derives  only  from  any  resulting  disrup¬ 
tion  of  current  supply  to  the  businesses  and  consumers 
purchasing  the  output  of  the  targeted  facilities  and  from 
any  loss  of  productive  facilities  (and  future  supply). 

For  that  reason,  measures  of  the  aggregate  value  of  chem¬ 
ical  sales  greatly  overstate  the  potential  for  losses  to  the 
economy.  For  example,  the  1997  Economic  Census, 
which  uses  the  same  industry  categories  that  EPA  uses  for 
its  Risk  Management  Program  data,  indicated  total  sales 
of  more  than  $540  billion  for  all  of  the  industries  that 
used  any  of  the  regulated  chemical  processes.  However, 
many  of  the  establishments  counted  in  that  census  do  not 
maintain  the  chemicals  of  concern  for  homeland  security. 
Also,  the  cost  figures  for  any  one  establishment  probably 
overstate  the  potential  loss  from  attack  because  replace¬ 
ment  supplies  would  be  available  from  spare  capacity 
throughout  the  industry,  including  supplies  from  inven¬ 
tory  and  imports.  In  some  cases,  altogether  different 
chemicals  and  production  processes  could  be  substituted. 
The  future  cost  to  industry  from  a  chemical  attack  would 


9.  For  a  summary  of  the  settlement,  see  Environmental  Protection 
Agency,  “Exxon  to  Pay  Record  One  Billion  Dollars  in  Criminal 
Fines  and  Civil  Damages  in  Connection  with  Alaskan  Oil  Spill” 
(press  release,  March  13,  1991),  available  atwww.epa.gov/history/ 
topics/valdez/02. htm.  Additional  background  is  available  at 
www.newsaic.eom/casecivil.html#exxon. 


reflect  only  the  increased  cost  of  supplying  those  replace¬ 
ments  or  substitutes.  (Considering  the  Exxon  Valdez  ex¬ 
ample,  all  of  the  lost  oil  was  replaced  from  other  sources, 
with  only  an  imperceptible  increase  in  world  oil  prices.) 

In  general,  any  increase  in  industry  costs  attributable  to 
terrorist  attacks  is  likely  to  be  small,  primarily  because  the 
chemical  industry  has  already  adapted  to  the  prospect  of 
disruptions  from  accidents,  and  terrorist  incidents  are 
likely  to  fall  in  the  realm  of  its  experience  and  planning. 
The  same  may  not  be  true  for  the  social  costs.  For  a  toxic 
release  that  spreads  over  a  significant  area,  the  social  cost 
itself  may  expand  to  include  the  disruption  of  activity  by 
local  business  and  local  populations  not  otherwise  in¬ 
volved  with  chemicals.  Also,  there  is  no  way  to  gauge  the 
full  economic  consequences  of  an  attack  that  involves  a 
theft  of  toxic  or  flammable  chemicals. 

A  further  example  in  which  the  social  costs  may  exceed 
the  private  costs  involves  the  disruption  of  supplies  of 
critical  chemicals  for  which  few  alternative  sources  ex¬ 
ist — such  as  chemicals  that  are  key  industrial  ingredients 
or  that  have  important  medical  uses.  There  may  be  only 
one  or  a  few  manufacturers  of  a  number  of  medicines, 
such  as  vaccines.  Without  stockpiles  of  those  items,  a 
supply  disruption  could  prove  harmful. 

Current  Programs  for  Safety  and 
Emergency  Preparedness 

Federal,  state,  and  local  programs  already  exist  that — 
with  varying  degrees  of  effectiveness — encourage  or  re¬ 
quire  the  operators  of  chemical  facilities  to  boost  their 
efforts  to  promote  safety  and  security  and  to  share  infor¬ 
mation  that  can  help  local  governments  plan  for  emer¬ 
gencies.^^  Much  of  the  overall  government  effort  for 
chemical  safety  occurs  at  the  state  and  local  level  and  is 
oriented  toward  emergency  preparedness.  The  federal  ef¬ 
fort  includes  worker-safety,  environmental,  and  informa¬ 
tion  programs  that  are  intended  to  support  local  activi¬ 
ties. 

The  Emergency  Planning  and  Community  Right-to- 
Know  Act  of  1986,  passed  largely  in  response  to  the  Bho¬ 
pal  accident,  represented  the  first  federal  initiative  to  pro¬ 
mote  safety  specifically  in  chemical  facilities.  The  law  re¬ 
quired  operators  of  chemical  facilities  to  participate  in 


10.  A  discussion  of  the  basic  laws  appears  in  Schierow,  Chemical  Plant 
Security. 
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community  emergency  planning  to  address  the  possibility 
of  an  accident,  provide  information  to  local  planners  on 
the  chemicals  they  handle,  and  notify  local  officials  of  any 
sudden  release.  It  also  mandated  the  establishment  of 
state  and  local  commissions  to  coordinate  planning  and 
response  for  large  releases  of  specified  hazardous  sub¬ 
stances  and  required  that  local  officials  inform  the  general 
public  about  chemical  hazards  and  emergency  plans  for 
them. 

Additional  requirements  came  in  the  Clean  Air  Act 
Amendments  of  1990.  The  CAAA  mandated  a  role  for 
the  Environmental  Protection  Agency  in  overseeing  risk- 
management  planning  at  facilities  that  handle  threshold 
quantities  of  certain  hazardous  chemicals  identified  in  the 
law  and  others  to  be  identified  by  EPA.  Operators  are  re¬ 
quired  to  have  programs  for  detecting,  preventing,  and 
minimizing  the  consequences  of  accidental  releases  of 
those  chemicals.  The  CAAA  also  required  the  preparation 
of  risk-management  plans  and  offsite  consequence  analy¬ 
ses  (for  worst-case  accidents). 

Further  federal  support  for  chemical  security  comes  from 
assistance  grants  to  local  governments  for  first-responder 
programs  and  from  technical  support  and  training  pro¬ 
grams,  such  as  those  of  the  Federal  Emergency  Manage¬ 
ment  Agency.  Among  recent  legislation,  the  Maritime 
Transportation  Security  Act  of  2002  requires  the  prepara¬ 
tion  of  vulnerability  assessments  for  chemical  facilities 
along  the  nation’s  waterways,  and  the  Public  Fdealth  Secu¬ 
rity  and  Bioterrorism  Preparedness  and  Response  Act  of 
2002  authorizes  the  creation  of  medical  stockpiles  to  pre¬ 
pare  for  biological  attacks. 

Ideas  for  New  Approaches  to  Chemical 
and  Hazardous-Material  Security 

The  gap  between  the  private  and  social  benefits  of  im¬ 
proved  security  for  chemical  facilities  and  transport  is 
likely  to  be  as  large  as  for  any  of  the  critical  industries 
considered  in  the  aftermath  of  September  1 1 .  Although 
precise  estimates  are  not  available,  information  on  acci¬ 
dents  in  the  chemical  industry,  company  assessments  of 
what  could  happen  in  a  severe  release  or  explosion,  and 
actual  terrorist  incidents  involving  chemicals  suggest  that 
the  risk  of  attack  is  real  and  that  losses  could  be  signifi¬ 
cant.  Any  losses  for  society  at  large  would  probably  be 
much  more  extensive  than  the  immediate  damage  to  the 
chemical  facility  that  was  targeted  or  whose  chemicals 
were  diverted  as  a  weapon  against  others.  Ideas  for  new 


approaches  that  would  internalize  the  expected  cost  of  an 
attack  to  chemical  producers,  socialize  the  cost  of  im¬ 
proved  security,  and  address  problems  with  incomplete 
information  all  deserve  attention.  In  some  cases,  the  in¬ 
tended  change  in  behavior  could  be  accomplished  by 
more  than  one  type  of  policy. 

Internalizing  the  Costs  of  an  Attack 
on  the  Chemical  Industry 

More-stringent  regulations  and  enhanced  enforcement  of 
safe  practices  are  options  that  would  internalize  the  ex¬ 
pected  cost  of  a  terrorist  attack  that  used  a  chemical  facil¬ 
ity  or  chemicals  in  transit  as  a  weapon  to  inflict  mass  ca¬ 
sualties.  Specifically,  those  options  could  include: 

■  Establishing  fees  or  taxes  on  sales  of  certain  hazardous 
chemicals  to  discourage  their  use. 

■  Establishing  new  regulations  for  tracking  the  owner¬ 
ship  of  hazardous  chemicals  that  could  be  used  as 
weapons. 

■  Establishing  new  regulations  governing  the  safe  trans¬ 
port  of  hazardous  chemicals  to  route  them  away  from 
population  centers. 

■  Creating  financial  disincentives  for  businesses  or  resi¬ 
dents  to  locate  in  danger  zones  (for  example,  by  re¬ 
quiring  higher  insurance  coverage  or  disallowing 
business  tax  incentives). 

■  Establishing  enhanced  incentives  and  protections  for 
reporting  on  unsafe  practices,  conflicts  with  best-tech¬ 
nology  safety  practices,  or  other  sources  of  vulnerabili¬ 
ties. 

Businesses  may  not  face  the  full  costs  of  damages  from  an 
attack  because  the  full  financial  resources  of  the  parent 
firm  are  not  at  stake  or  because  the  required  limits  for  pri¬ 
vate  insurance  coverage  are  too  low.  Raising  the  stakes 
would  increase  private  incentives  to  make  chemicals  and 
chemical  production  safer  and  could  be  accomplished  by: 

■  Supporting  industry  efforts  to  pool  financial  resources 
to  settle  claims  against  any  single  business  in  the  in¬ 
dustry; 

■  Requiring  chemical  plants  to  purchase  higher  mini¬ 
mum  coverage  levels,  regardless  of  cost;  and 
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■  Requiring  private  insurers  to  offer  higher  coverage 
levels. 

The  Congress  has  considered  a  number  of  measures  that 
would  cause  the  chemical  industry  to  assume  increased 
costs  of  security.  For  example,  the  Chemical  Facilities  Se¬ 
curity  Act  of  2003  (S.  994)  would  have  required  DFdS  to 
develop  regulations  designed  to  increase  security  at  facili¬ 
ties  vulnerable  to  unauthorized  releases  of  hazardous 
chemicals,  in  part  by  requiring  owners  and  operators  of 
those  facilities  to  perform  vulnerability  assessments  and 
to  establish  site  security  plans.  (Although  the  Congres¬ 
sional  Budget  Office  did  not  estimate  the  direct  cost  to 
industry  of  those  measures,  it  estimated  that  the  federal 
cost  of  implementing  S.  994  would  be  $216  million  over 
the  first  five  years,  assuming  necessary  appropriations.^  ^ 
Of  that  amount,  DFdS  would  use  $126  million  to  de¬ 
velop  the  required  regulations,  maintain  chemical  facili¬ 
ties’  site  information,  and  enforce  the  bill's  new  require¬ 
ments.) 

Socializing  the  Costs  of  Improved 
Chemical  Industry  Security 

The  government  may  have  a  cost  advantage  in  perform¬ 
ing  certain  security  services  that  are  necessary  to  reduce 
the  expected  social  costs  of  a  terrorist  attack  on  a  chemi¬ 
cal  plant.  For  example,  the  government  could  directly 
provide  for  the  perimeter  security  of  chemical  plants,  as 
the  Coast  Guard  already  does  to  some  extent  for  facilities 
located  along  navigable  waterways. 

Among  the  provisions  of  S.  994  were  federal  grants  to  im¬ 
prove  security  at  agricultural  businesses  that  produce  or 
sell  hazardous  chemicals  (such  as  fertilizer),  which  CBO 
estimated  to  have  a  federal  cost  of  $90  million  over  five 
years. 

Other  ways  to  spread  the  costs  of  improved  security  could 
include  subsidizing  the  cost  of  private  insurance  or  pro¬ 
viding  government  insurance.  Such  insurance  programs 
on  their  own  might  help  pay  for  the  damages  from  an  at¬ 
tack,  but  they  would  not  necessarily  cause  the  industry  to 
make  actual  security  improvements  unless  the  financial 
resources  of  the  business  or  insurance  underwriter  were  at 
stake  as  well.  Only  then  would  the  insurer  have  an  incen- 


11.  See  Congressional  Budget  Office,  Cost  Estimate  for  S.994,  Chem¬ 
ical  Facilities  Security  Act  of  200i  (May  10,  2004). 

12.  Ibid. 


tive  to  induce  industry  to  improve  its  safety — for  exam¬ 
ple,  by  making  coverage  or  premiums  contingent  on 
specified  safe  practices. 

Government  funding  for  security  improvements  also 
could  subsidize  the  sale  of  safer  chemicals,  subsidize  ex¬ 
penditures  on  safer  production  materials  and  processes 
and  safer  transport  methods,  and  provide  assistance  for 
people  and  businesses  that  wanted  to  move  away  from 
dangerous  sites. 

Improving  Information 

The  general  public,  local  emergency  planners,  and  per¬ 
haps  even  the  chemical  industry  lack  a  wide  range  of  in¬ 
formation  about  the  potential  scope  of  damages  from  a 
terrorist  attack.  To  the  extent  that  the  potential  cost  is  un¬ 
derestimated,  spending  to  counter  those  damages  will  be 
too  low.  Another  area  in  which  information  could  be  im¬ 
proved  involves  alternative  technologies.  Alternative 
chemicals  or  chemical  processes  may  exist  that  would  be 
inherently  safer  in  some  applications,  but  information  on 
them  is  not  widespread. 

There  are  also  dilemmas  concerning  information  about 
all  of  the  critical  industries.  One  dilemma  is  how  to  bal¬ 
ance  the  need  for  good  information  on  potential  vulnera¬ 
bility  with  the  need  to  keep  that  information  from  people 
who  could  exploit  it  to  launch  a  more  effective  attack. 
Another  problem  is  how  to  disentangle  industry’s  normal 
disincentive  to  make  business  information  public  from  le¬ 
gitimate  security  concerns  about  disclosure.  The  Gon- 
gress  restricted  access  to  offsite  consequence  analyses  be¬ 
fore  September  11,  and  more  recently,  concerns  about 
security  prompted  DFdS  to  protect  security-related  data 
submitted  voluntarily  by  critical-infrastructure  compa¬ 
nies  from  disclosure  under  the  Freedom  of  Information 
Act.  Problems  related  to  incomplete  information  suggest 
several  types  of  options  to  help  boost  security,  including; 

■  Establishing  emergency  planning  zones  that  reflect  re¬ 
lease  scenarios  consistent  with  the  potential  scope  of  a 
terrorist  attack.  (That  measure  could  indicate  more- 
extreme  damages  than  in  EPA’s  alternative-release  sce¬ 
narios,  now  used  by  many  communities  in  emergency 
planning.) 

■  Better  informing  the  public  on  where  dangerous 
chemicals  are,  either  by  regulation  or  through  public/ 
private  partnerships  to  disseminate  information. 
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■  Establishing  national  property  zoning  (similar  to 
FEMA’s  flood-zone  mapping)  to  help  inform  new  pur¬ 
chasers  about  local  dangers;  setting  national  restric¬ 
tions  on  what  activities  can  occur  near  dangerous 
chemicals  (in  particular,  other  critical  industries);  and 
dictating  safe  routes  for  transporting  dangerous  chem¬ 
icals.  (All  of  those  responsibilities  now  he  with  local 
governments.) 


■  Disseminating  information  to  businesses  on  inher¬ 
ently  safer  chemicals  and  safer  production  processes 
(through  public  reports,  demonstration  projects,  in¬ 
centives  such  as  research  and  development  grants,  and 
public/private  partnerships  such  as  EPAs  product- 
labeling  programs  and  information-sharing  coali¬ 
tions). 


CHAPTER 


4 

Electricity  Service 


leccricity  service  is  one  element  of  cricical  infra- 
Structure  for  which  the  post-September  1 1  benefits  of  im¬ 
proving  security  may  not  be  very  different  from  the  pre- 
September  1 1  benefits.  In  general,  the  vulnerabilities  that 
the  nation’s  electricity  supply  currently  face  from  terror¬ 
ism  are  similar  to  those  that  the  industry  has  long  faced 
from  extreme  weather  and  other  natural  events,  acci¬ 
dents,  and  equipment  failures — occurrences  that  could 
disable  any  of  the  major  physical  components  of  the  sup¬ 
ply  network  or  disrupt  performance  of  the  system’s  con¬ 
trol  centers.  Potential  losses  from  such  disruptions  would 
be  limited  and  of  relatively  short  duration  because  the  in¬ 
dustry  and  electricity  customers  are  generally  well  pre¬ 
pared  for  such  failures.  However,  greater  losses  could  oc¬ 
cur  if  attacks  on  key  facilities  were  coordinated  with  the 
intent  of  causing  a  widespread  and  prolonged  system  fail¬ 
ure.  Concerns  about  terrorist  attacks  may  give  added  im¬ 
petus  to  proposals  already  under  way  to  improve  the  reli¬ 
ability  of  power  supplies. 

Other  concerns  related  to  electricity  service  are  the  secu¬ 
rity  of  nuclear  power  facilities  (discussed  in  Chapter  2) 
and  the  security  of  the  nation’s  large  dams  and  reservoirs. 
Many  of  the  largest  dams  support  hydropower  produc¬ 
tion,  although  the  vast  majority  serve  other  purposes. 

The  Department  of  Homeland  Security  identifies  large 
dams  as  critical  infrastructure  because  of  the  potential 
downstream  harm  that  the  breaching  of  such  a  dam  could 
cause  (see  Box  4-1).  This  paper  does  not  explore  options 
for  improving  the  safety  of  dams. 

Vulnerabilities  from  Disruption 
of  Regional  Transmission 

The  major  vulnerabilities  of  electricity  supplies  are  associ¬ 
ated  with  regional  transmission  systems — the  power  grids 
that  carry  electricity  at  high  voltage  from  power  sources 
to  communities.  Transmission  systems  include  the  sub¬ 


stations  and  high-voltage  transformers  that  first  “step  up” 
the  force  of  the  current  as  it  moves  from  generators  onto 
the  transmission  lines  and  then  “step  down”  that  current 
as  it  moves  onto  the  low-voltage  lines  necessary  for  local 
distribution.  Generation  facilities — other  than  nuclear 
power  plants  and  hydropower  dams,  which  present  a  dif¬ 
ferent  type  of  concern — are  generally  not  a  major  source 
of  vulnerability  to  electricity  supplies  because  there  are  so 
many  generators  and  so  much  excess  generation  capacity. 
Similarly,  although  highly  exposed  to  attack,  the  distribu¬ 
tion  systems  for  carrying  electricity  at  low  voltage  over 
the  last  few  miles  directly  to  homes  and  businesses  would 
not  make  a  good  target,  as  a  break  in  those  lines  would 
probably  be  well  within  the  range  of  the  industry’s  experi¬ 
ence  and  capacity  for  making  speedy  repairs. 

Assaults  on  Individual  Components 

Experiences  with  major  outages  involving  bulk  power 
(that  is,  generation  and  transmission)  suggest  ways  in 
which  a  targeted  attack  on  those  systems  could  lead  to 
widespread  outages.  Of  particular  concern  for  supply  dis¬ 
ruptions  are  assaults  on  selected  individual  compo¬ 
nents — or  combinations  of  components — that  could  take 
advantage  of  system  safeguards  to  produce  a  cascading  se¬ 
quence  of  failures  and  widespread  service  disruptions.  For 
example,  assaults  on  transmission  lines  at  multiple  points 
or  at  key  nodes  could  cause  failures  that  operators  in  con¬ 
trol  centers  could  not  adjust  to  quickly;  cyber  attacks  on 
the  control  centers  themselves  could  also  wreak  havoc. 
But  in  general,  such  attacks  would  result  in  losses  only  for 
short  periods. 

A  principal  concern  about  supply  losses  for  a  longer  pe¬ 
riod  relates  to  attacks  on  the  high-voltage  transformers 
where  the  force  of  the  current  is  stepped  down  from  re¬ 
gional  transmission  lines  to  local  distribution  lines.  The 
sudden  loss  of  multiple  substations  could  precipitate  an 
imbalance  between  the  amount  of  power  being  pushed 


30  HOMELAND  SECURITY  AND  THE  PRIVATE  SECTOR 


Box  4-1 . 

Vulnerabilities,  Potential  Losses,  and  Regulatory  Regimes 
for  Large  Dams  and  Reservoirs 


Compared  with  chemical  facilities  or  nuclear  plants, 
the  largest  dams  are  inherently  secure  structures  by 
virtue  of  their  massive  design.  Yet  if  a  large  dam  up¬ 
stream  from  a  major  population  center  was  breached, 
large-scale  loss  of  life  and  major  economic  damage 
could  result.  Dams  are  continuously  vulnerable  to 
extremes  in  weather,  earthquakes,  and  failures  be¬ 
cause  of  age  and  inadequate  maintenance.  And  with 
the  increased  threat  of  attacks  since  September  1 1 , 
some  preventive  actions  that  may  not  have  been  cost- 
effective  in  the  face  of  only  natural  events  now  may 
be  worth  undertaking. 

The  actual  vulnerability  of  any  dam  to  a  terrorist  at¬ 
tack  that  could  release  large  volumes  of  water  would 
depend  on  the  uses  of  the  dam,  its  basic  design,  and 
possibly  its  state  of  repair.  Of  greatest  concern  are 
those  dams  that  are  sited  and  designed  to  achieve 
maximum  water  storage — whether  for  recreation, 
flood  control,  or  hydropower  production.  Among 
the  different  designs,  earthen  and  rock-fill  dams  may 
be  the  most  vulnerable  to  a  concerted,  small-scale  ef¬ 
fort  to  exploit  weak  spots.  The  two  most  notable 
dam  failures  in  U.S.  history — the  Johnstown  Flood 
of  1889  and  the  Teton  Dam  collapse  of  1976 — in¬ 
volved  earthen  structures.  Age  is  a  big  concern  be¬ 
cause  most  federally  constructed  dams  were  com¬ 
pleted  by  the  mid- 1900s,  and  two-thirds  of  the 
nonfederal  dams  that  are  licensed  by  the  Federal  En- 
ergy  Regulatory  Commission  (FERC)  are  more  than 
50  years  old.  ^ 

Fiistorical  experience  with  accidents  gives  some  indi¬ 
cation  of  the  human  losses  that  could  result  from  an 


intentional  breach  of  a  dam.  Total  failures  are  very 
rare,  but  they  have  occurred  with  disastrous  results. 
After  Pearl  Fiarbor  and  September  1 1 ,  the  event  that 
caused  the  single  greatest  loss  of  life  in  this  country 
was  the  Johnstown  Flood  of  1889,  in  which  more 
than  2,200  people  died.  The  failure  of  the  newly 
built  Teton  Dam  in  Idaho  in  1976  resulted  in  1 1 
deaths,  20,000  households  evacuated,  and  perhaps 
$800  million  in  damages  (beyond  the  cost  of  the 
dam  itself). 

Economic  losses  from  flooding  would  come  from 
damage  to  downstream  properties  and  to  the  dam 
itself,  reflecting  the  lost  value  of  any  services  the 
structure  had  been  providing  (including  power  gen¬ 
eration,  municipal  water,  irrigation  water,  and  recre¬ 
ation).  Not  all  consequences  need  be  negative;  in 
fact,  some  environmental  advocates  would  point  to 
gains  for  some  flora  and  fauna  by  letting  rivers  run 
free. 

Recognition  of  private  and  public  disincentives  to 
build  and  operate  dams  in  a  way  that  provides  the 
most  cost-effective  level  of  protection  for  down¬ 
stream  communities  has  led  state  governments  and 
federal  agencies  to  extensively  regulate  nonfederal 
dams.  The  security  of  federal  dams,  which  include 
many  of  the  nation’s  largest  hydropower  projects,  is 
the  responsibility  of  the  federal  agencies  that  build 
and  operate  them. 


1 .  General  Accounting  Office,  Federal  Power:  Implications  of 
Reduced  Maintenanee  and  Repairs  of  Federal  Hydropower 
Plants,  GAO/RCED-99-63  (March  1999). 


onto  the  wires  from  generation  and  the  amount  being 
pulled  off  for  consumption  (known  as  system  load), 
which  could  threaten  the  regional  grid  as  well  as  sever 
electricity  to  the  targeted  community.  ^  (Power  could  be 
rerouted  to  compensate  for  the  loss  of  only  one  or  a  few 
substations,  depending  on  the  load  balance  in  the  af¬ 
fected  region.)  Unlike  with  other  equipment  problems — 
such  as  damaged  towers  and  downed  lines — the  industry 


does  not  have  experience  with  emergency  losses  and  sub¬ 
sequent  replacement  of  multiple  transformers.  High- 


1.  The  consequences  of  an  attack  on  multiple  substations  are  dis¬ 
cussed  in  U.S.  Congress,  Office  of  Technology  Assessment,  Physi¬ 
cal  Vulnerability  of  Electric  Systems  to  Natural  Disasters  and 
Sabotage,  OTA-E-453  (June  1990),  available  atwww.wws.prince- 
ton.edu/cgibin/byteserv.prl/-ota/disk2/1990/9034/9034.PDF. 
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Box  4-1 . 

Continued 


The  vast  majority  of  the  country’s  dams  are  small 
nonfederal  structures  that  are  not  used  to  generate 
hydropower.  They  are  regulated  by  the  states  and  lo¬ 
cal  governments,  although  the  Federal  Emergency 
Management  Agency  (FEMA)  has  an  interest  in 
those  dams,  too.^  The  National  Dam  Safety  Program 
Act,  passed  in  1996,  increased  FEMA’s  authority  to 
provide  financial  assistance  to  the  states  for  strength¬ 
ening  their  own  dam  safety  programs.  FEMA  works 
with  the  states  to  promote  dam  safety  legislation,  es¬ 
tablish  emergency  action  planning  for  dams  that 
present  potential  hazards,  inspect  dams  regularly, 
and  track  dams  in  need  of  remediation.  With  federal 
assistance,  the  states  reportedly  inspected  14,000 
dams  in  2002.^ 

The  Federal  Energy  Regulatory  Commission  regu¬ 
lates  the  construction,  operation,  and  maintenance 
of  nonfederal  dams  that  are  built  for  hydropower 
generation.  In  addition,  most  projects  that  affect 
navigable  waters,  occupy  federal  lands,  or  use  water 
power  from  a  government  dam  require  a  FERC  li¬ 
cense  to  operate.  The  commission  is  currently  re¬ 
sponsible  for  dam  safety  at  more  than  2,600  licensed 
and  exempted  dams  and  related  water  retention 

2.  Information  on  state  regulators  is  available  from  the  Associa¬ 
tion  of  State  Dam  Safety  Officials,  an  organization  of  state 
and  federal  regulators,  dam  operators,  and  others  interested 
in  dam  safety,  at  www.damsafety.org. 

3.  See  Federal  Emergency  Management  Agency,  FEMA  466, 
Dam  Safety  and  Security  in  the  United  States:  A  Progress 
Report  on  the  National  Dam  Safety  Program  in  Fiscal  Years 
2002  and 2003,  available  atwww.fema.gov/fima/damsafe. 


structures.  FERC  requires  all  operators  to  develop 
emergency  action  plans  that  indicate  how  to  protect 
people  and  property  in  the  event  of  a  natural  disaster 
or  sabotage  and  how  to  quickly  restore  power. In 
addition,  for  all  larger  projects,  operators  must  pro¬ 
vide  a  security  plan  that  identifies  protective  mea¬ 
sures  and  evaluates  on-site  security  systems,  as  well  as 
a  vulnerability  assessment  that  identifies  vulnerable 
project  features,  threats,  the  consequences  of  an  at¬ 
tack,  and  the  likely  effectiveness  of  security  systems 
to  counter  an  attack. 

The  security  of  federal  dams  is  the  direct  responsibil¬ 
ity  of  agencies  such  as  the  Bureau  of  Reclamation 
and  the  Corps  of  Engineers,  which  own  and  operate 
the  largest  federal  dams  and  associated  power-gener¬ 
ating  facilities.  The  Tennessee  Valley  Authority  also 
owns  the  dams  in  its  hydropower  systems  and  sells 
that  power.  Some  smaller  dams  are  owned  by  the  Bu¬ 
reau  of  Land  Management,  the  Forest  Service,  and 
several  other  agencies.  All  of  those  federal  operators 
are  subject  to  federal  guidelines  on  dam  safety,  al¬ 
though  the  guidelines  do  not  establish  technical 
standards  that  the  agencies  must  meet.  As  the  desig¬ 
nated  coordinator  of  the  National  Dam  Safety  Pro¬ 
gram,  FEMA  also  monitors  the  progress  of  federal 
dam  operators  in  implementing  the  federal  guide¬ 
lines  for  dam  safety. 

4.  See  Federal  Energy  Regulatory  Commission,  FERC  Security 
Program  for  Flydropower  Projects,  Revision  1  (November  15, 
2002),  available  at  www.ferc.gov/industries/hydropower/ 
safety/ security/ securitytext.pdf. 


voltage  transformers  can  take  months  to  replace  because 
relatively  few  are  held  in  inventory,  they  generally  are  cus¬ 
tom-made  to  reflect  the  load  requirements  of  individual 
utilities,  and  they  are  very  large  (on  the  order  of  400,000 
pounds)  and  difficult  to  transport.^ 

Information  on  the  number  of  generation-  and  transmis¬ 
sion-related  service  losses  gives  some  indication  of  the 


vulnerability  of  electricity  supplies.  The  North  American 
Electric  Reliability  Council  (NERC)  lists  more  than  500 


2.  For  example,  see  news  releases  by  APS,  the  investor-owned  utility 
serving  Phoenix:  “APS  Acquires  Replacement  Transformer  from 
BPA,”  July  10,  2004,  and  “APS  Brings  Replacement  Transformer 
into  Service,”  August  9,  2004,  available  at  www.aps.com/ 
general_info/ newsrelease/ default.html  ?year=2004. 
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such  outages  in  the  period  from  1984  to  2000.^  Nearly 
three  per  year  involved  losses  of  at  least  1 ,000  megawatts 
(comparable  to  the  supply  from  any  of  the  country’s  larg¬ 
est  generation  plants).  And  19  from  that  list  involved  dis¬ 
ruptions  for  more  than  1  million  customers  (households 
and  businesses).  Of  the  58  bulk  power  outages  in  2000 
alone,  about  half  were  attributable  to  natural  events  (26 
to  weather  and  two  to  wildfires).  The  rest  were  caused  by 
human  error  and  equipment  failure  (24)  or  by  a  contrac¬ 
tual  failure  to  provide  enough  supply  to  meet  demand 
(six).  Most  of  those  outages  were  brief  and  affected  rela¬ 
tively  few  people,  with  notable  exceptions.  A  1998  ice 
storm  in  southern  Canada  and  New  York  left  1.6  million 
people  without  power  for  up  to  a  month.  The  outage  of 
August  2003,  the  largest  to  date,  blacked  out  power  for  a 
day  or  more  to  perhaps  50  million  people  in  the  upper 
Midwest,  eastern  Canada,  New  York,  and  New  England. 

The  Problem  of  Systemwide  Failure 

In  the  history  of  bulk  power  outages,  single-component 
failures  are  the  most  common,  but  many  of  the  largest 
outages — including  the  August  2003  blackout — involved 
cascading  failures.  In  a  cascading  failure,  problems  with  a 
key  transmission  link  cause  power  to  be  rerouted  over  ad¬ 
jacent  lines,  which  then  become  overloaded  and  automat¬ 
ically  shut  down.  The  effects  cascade  from  the  initial 
point  of  disturbance  onto  other  lines  and  generators,  suc¬ 
cessively  tripping  more  protective  devices  and  knocking 
out  power  over  a  broader  area. 

Two  factors  are  at  play  in  the  inherent  vulnerability  of  re¬ 
gional  grids  to  cascading  failures.  One  is  the  physical  re¬ 
quirement  that  the  amount  of  power  going  into  the  grid 
(from  local  generation  or  from  neighboring  grids)  match 
the  power  that  consumers  are  taking  off  the  grid.  When 
that  balance  is  upset,  system  safeguards  kick  in  to  keep 
wires  from  overheating  or  consumer  electrical  equipment 
from  being  damaged.  The  other  factor  is  the  basic  loop 
design  of  the  regional  grids,  where  power  moves  into  the 
grid  from  multiple  generators  (and  from  neighboring  net- 


3.  In  the  NERC  data,  “outages”  reflect  interruptions,  unusual  occur¬ 
rences,  demand  and  voltage  reductions,  and  public  appeals.  Dis¬ 
cussions  of  those  data  appear  in  Sarosh  Talukdar  and  others, 
“Cascading  Failures:  Survival  Versus  Prevention,”  Electric  Journal, 
vol.  16,  no.  9  (November  2003);  Jay  Apt  and  others,  “Electrical 
Blackouts:  A  Systemic  Problem,  Issues  in  Science  and  Technology, 
vol.  20,  no.  4  (Summer  2004);  and  Alexander  Parrel  and  others, 
“Bolstering  the  Security  of  the  Electric  Power  System,”  Issues  in 
Science  and  Technology,  vol.18,  no.  3  (Spring  2002). 


works)  and  then  around  to  the  multiple  communities  be¬ 
ing  served.  (The  simplest  loop  would  directly  connect  a 
single  generator  with  a  single  community.)  Unlike  the 
spoke-like  design  of  distribution  systems,  in  which  only 
the  customers  down  the  line  from  a  break  would  be  af¬ 
fected,  an  assault  on  the  transmission  loop,  transformer 
substations  (especially  those  connecting  transmission  and 
distribution  systems),  or  regional  control  centers  could 
affect  all  users  if  system  safeguards  were  not  available  to 
isolate  problems  and  restore  the  balance  between  genera¬ 
tion  and  consumer  load. 

Research  on  How  Systems  Could  Fail 

The  equipment  used  in  the  production  and  transmission 
of  electricity  and  the  electronic  monitoring  devices  and 
other  controls  on  which  operators  rely  would  be  vulnera¬ 
ble  to  physical  attack  because  those  targets  are  located 
outdoors  and  have  little  active  protection.  The  National 
Research  Council  recently  reported  that  an  assault  on  any 
individual  segment  of  the  network  would  probably  cause 
only  a  local  disruption,  but  “a  coordinated  attack  on  a  se¬ 
lected  set  of  key  points  in  the  system  could  result  in  a 
long-term,  multi-state  blackout.”  In  a  war-game  simula¬ 
tion  carried  out  at  the  Naval  War  College,  experts  de¬ 
scribed  an  attack  on  regional  power  supplies  that  com¬ 
bined  a  physical  attack  on  transmission  towers  at  key 
points  with  a  cyber  attack  on  control  systems  in  the  same 
region.'^  Cyber  attacks  could  take  the  form  of  a  computer 
virus,  introduced  through  Internet  connections  and  the 
utilities’  private  networks,  that  would  target  supervisory 
control  and  data-acquisition  systems  that  utilities  use  to 
manage  power  flows. ^ 

Potential  Losses  from  Disruption 
of  Vital  Services 

Although  there  are  indications  that  the  total  costs  from 
losing  power  for  a  short  time  might  not  be  great,  even  a 


4.  The  “Digital  Pearl  Harbor”  war  game,  conducted  in  July  2002, 
was  sponsored  by  the  Gartner  Group  and  the  U.S.  Naval  War 
Gollege.  A  description  of  the  scenario  for  a  regional  power  disrup¬ 
tion  appears  in  related  research,  “Utilities  Should  Upgrade  the 
Security  of  Their  Operations,”  October  3,  2002,  available  at 
www3.gartner.com/2_events/audioconferences/dph/dph.html. 

5.  For  a  general  discussion  of  threats  to  control  systems  for  electric 
power  (and  related  network  industries),  see  Gongressional 
Research  Service,  Critical  Infrastructure:  Control  Systems  and  the 
Terrorist  Threat,  CRS  Report  for  Gongress  RL31534  (updated 
January  20,  2004). 
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temporary  loss  could  impose  some  costs  in  terms  of  hu¬ 
man  lives,  environmental  damage,  and  the  economy. 
Specific  concerns  about  environmental  consequences  re¬ 
late  to  power  losses  at  water  treatment  and  sewage  plants. 
In  the  August  2003  blackout,  concerns  about  potential 
contamination  of  local  water  supplies  as  a  consequence  of 
even  a  brief  shutdown  in  treatment  facilities  prevented 
people  from  using  their  water  service  for  many  days  after 
power  was  restored.  Impaired  operations  at  sewage  treat¬ 
ment  plants  could  have  further  environmental  impacts  if 
they  caused  raw  sewage  to  be  released  into  rivers  or  lakes. 

Also  at  stake  in  a  power  loss  are  injuries  that  occur  in 
darkened  buildings,  heart  stress,  consequences  of  limited 
emergency  service  (for  example,  from  restricted  access  to 
high-rise  buildings),  and  health  problems  caused  by  dis¬ 
rupted  life -support  apparatus  and  the  loss  of  refrigeration 
for  medication  or  food  subject  to  spoilage.  A  power  loss 
also  may  compromise  government  emergency  services 
and  telecommunications  to  the  extent  that  emergency 
calls  cannot  be  placed. 

A  loss  of  power  also  could  impose  economic  costs  related 
to  disruptions  in  commercial,  government,  or  residential 
activity  as  well  as  physical  damages  to  electricity  infra¬ 
structure.  At  a  basic  level,  consumer  costs  arise  from 
breaks  in  electricity  service  because  utility  customers  have 
limited  flexibility  to  switch  to  other  sources  of  electricity 
or  completely  different  sources  of  energy.  Immediate 
costs  for  business  customers  could  result  from  lost  pro¬ 
duction  and  inventory,  damaged  equipment  (including 
damage  to  computer  systems  and  electronic  storage  sys¬ 
tems),  and  restart  costs.  For  residential  customers,  direct 
costs  from  the  loss  of  lighting,  refrigeration,  heating  and 
cooling,  and  the  use  of  other  appliances  may  be  associ¬ 
ated  with  threats  to  health  and  safety  as  well  as  dimin¬ 
ished  lifestyle.  Some  of  those  losses  may  be  erased  when 
power  comes  back  on,  but  there  may  be  capital  losses, 
too — for  example,  from  lost  data  on  computer  systems  or 
appliances  damaged  by  power  surges — that  have  longer- 
lasting  consequences. 

Evidence  from  past  blackouts  demonstrates  that  the  elec¬ 
tricity  transmission  system  has  been  designed  so  that  line 


failures  do  not  cause  physical  damage  to  the  system  be¬ 
yond  the  initial  breaks.  As  a  result,  if  difflcult-to-replace 
equipment,  such  as  high-voltage  transformers,  is  not  di¬ 
rectly  targeted  in  the  attack,  power  can  be  restored  rela¬ 
tively  quickly  and  economic  losses  can  be  minimal.  The 
response  of  electric  utilities  to  the  September  1 1  attack 
on  the  World  Trade  Center  shows  how  robust  the  elec¬ 
tricity  network  is  and  how  good  utility  service  people  are 
at  restoring  service.  That  attack  destroyed  two  electric 
substations  and  severely  damaged  five  subtransmission 
feeders,  in  addition  to  numerous  other  distribution  facili¬ 
ties.*^  The  damage  cut  off  service  to  13,000  customers, 
many  of  which  were  buildings  serving  key  financial  mar¬ 
kets.  The  electricity  supplier  restored  service  to  most  of 
those  customers  within  eight  days  and  enabled  major  fi¬ 
nancial  institutions  to  reopen  after  only  six  days. 

An  example  of  a  much  broader,  regional  disruption  was 
the  Northeast-Midwest  blackout  of  August  14,  2003, 
which  affected  about  50  million  people.  In  that  case,  it 
took  five  days  to  fully  restore  service  throughout  the  re¬ 
gion,  although  most  customers  had  power  within  24 
hours.  The  Department  of  Energy  estimated  the  total 
cost  of  the  blackout  at  $6  billion,  with  the  biggest  cost 
coming  from  lost  income  and  earnings.^  However,  data 
on  actual  electricity  use  in  that  region  in  August  2003 
show  no  discernible,  unseasonable  change  in  total  power 
consumption  attributable  to  the  blackout — that  is,  what¬ 
ever  drop  in  power  use  occurred  over  those  days  appears 


6.  North  American  Electric  Reliability  Council,  2001  System  Distur¬ 
bances  (Princeton,  N.J.:  NERC,  April  2003). 

7.  See  Department  of  Energy,  U.S. -Canada  Power  System  Outage 
Task  Eorce,  Final  Report  on  the  August  l4th  Blackout  in  the  United 
States  and  Canada:  Causes  and  Recommendations  (April  2004). 
Other  sources  on  the  costs  of  the  blackout  are  ICE  Consulting, 
The  Economic  Cost  of  the  Blackout:  An  Issue  Paper  on  the  Northeast¬ 
ern  Blackout  (Fairfax,  Va.:  ICE  Consulting,  August  15,  2003), 
available  at  www.icfconsulting.com/markets/energy/doc_files/ 
blackout-economic-costs.pdf;  and  Patrick  Anderson  and  Ilhan  K. 
Geckil,  Northeast  Blackout  Likely  to  Reduce  U.S.  Earnings  by  $6.4 
Billion,  Working  Paper  2003-2  (Lansing,  Mich.:  Anderson  Eco¬ 
nomic  Group,  August  19,  2003),  available  at  www.anderson 
economicgroup.com/Pubs/articles_pressreleases/aegreports/ 
blackout_AEGwp2003-2.pdf 
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to  have  been  made  up  after  the  lights  came  back  on.^ 
Economic  activity  after  the  disruption  would  have  made 
up  for  most  of  the  temporary  losses  that  DOE  referred  to 
as  well. 

Individuals  directly  affected  by  a  power  loss  may  take  a 
different  view.  The  industry  commonly  describes  con¬ 
sumers’  concerns  about  supply  interruptions  in  terms  of 
“reliability”  of  service.  Studies  of  the  economic  value  of 
that  reliability  (or,  equivalently,  the  costs  of  interrup¬ 
tions)  indicate  that  many  customers  would  have  been 
willing  to  pay  perhaps  1 00  times  their  normal  electricity 
bill  for  a  disrupted  period  to  avoid  that  loss  of  power.  ^ 

Regulating  for  Reliable 
Electricity  Service 

Utility  regulation  and  voluntary  industry  standards  gov¬ 
ern  the  reliability  of  electricity  supplies.  Regulatory  bod¬ 
ies  represent  the  interests  of  electric  utility  customers, 
working  to  ensure  that  the  utilities  maintain  a  level  of  re¬ 
liability  that  reflects  the  social  costs  of  service  interrup¬ 
tions — not  just  the  private  costs  to  utilities  from  damaged 
equipment  and  lost  sales.  Under  current  standards,  the 
utilities  generally  achieve  the  required  level  of  reliability 
by  maintaining  sufficient  excess  capacity  to  overcome  the 
loss  of  at  least  one  important  component  at  a  time.  The 
regulatory  structure  of  the  industry  is  changing,  with 
large  parts  of  the  wholesale  trade  in  electricity  being 
priced  at  market  rates,  but  most  retail  rates  continue  to 
reflect  utilities’  guaranteed  recovery  of  expenditures  on 
reliability.  For  the  most  part,  rates  for  retail  sales,  trans¬ 
mission  services,  and  some  wholesale  trade  are  approved 
by  state  public  utility  commissions  (PUCs),  the  Federal 
Energy  Regulatory  Commission,  and  other  government 
entities  on  the  basis  of  prudent  expenses  by  utilities  plus  a 
markup  that  allows  them  to  earn  a  given  rate  of  return  on 
their  capital  investments. 


8.  For  example,  see  monthly  data  on  retail  electricity  sales  from 
Department  of  Energy,  Energy  Information  Administration,  Elec¬ 
tric  Power  Monthly,  DOE/EIA-0226  (various  issues) ,  which  indi¬ 
cate  no  relative  drop  in  sales  from  July  2003  to  August  2003 
compared  with  those  months  in  2002  and  2004. 

9.  Estimates  of  the  value  of  service  reliability  vary  widely  depending 
on  many  factors,  such  as  the  type  of  customer  and  the  time  and 
length  of  the  outage.  Eor  a  detailed  review  of  estimates,  see 
Lawrence  Berkeley  Laboratory,  Scoping  Study  on  Trends  in  the  Eco¬ 
nomic  Value  of  Electricity  Reliability  in  the  U.  S.  Economy  (Berkeley, 
Calif:  Lawrence  Berkeley  Laboratory,  June  2001). 


Because  utilities  interact  with  other  utilities  and,  increas¬ 
ingly,  with  independent  generators  to  move  power  over 
large  regional  networks,  they  are  interdependent  in  pro¬ 
viding  their  respective  customers  with  reliable  supply. 

The  industry  has  adopted  voluntary  standards  to  help 
prevent  outages  to  customers  that  result  from  disruptions 
by  other  suppliers.  In  response  to  the  nation’s  first  large 
blackout,  in  New  York  in  1965,  the  electric  power  indus¬ 
try  established  the  North  American  Electric  Reliability 
Council  to  oversee  the  overall  reliability  of  wholesale  elec¬ 
tricity  supplies  in  North  America.  Utilities’  participation 
in  the  NERC  is  voluntary,  but  the  organization  exercises 
significant  influence  over  reliability  planning  and  coordi¬ 
nation  because  utilities  recognize  their  high  degree  of  in¬ 
terdependence. 

Under  NERC’s  voluntary  standards,  utilities  operate  the 
network  with  a  contingency  for  the  failure  of  network 
components  that  is  known  as  “N  minus  one.”  That 
means  the  transmission  network  is  operated  so  that  it 
could  continue  to  serve  customers  fully  if  a  single  critical 
network  component  failed.  (Critical  equipment  includes 
generators,  segments  of  the  transmission  grid,  and  high- 
voltage  transformers.)  In  the  event  of  such  a  failure,  oper¬ 
ators  are  supposed  to  quickly  adjust  the  network  to  a  new 
N-minus-one  status  in  which  the  system  can  withstand 
the  failure  of  an  additional  component.  If  operators  can¬ 
not  restore  the  network  to  that  status,  they  are  supposed 
to  take  other  actions  to  ensure  that  any  effects  are  isolated 
to  the  local  area  so  that  neighboring  systems  cannot  be  af¬ 
fected.  (Under  existing  standards,  all  power  systems  have 
protective  devices  such  as  fuses  to  ensure  that  any  disrup¬ 
tion  in  power  quality  cannot  physically  damage  the 
equipment.  In  the  event  of  a  power  surge  that  could  not 
be  controlled  by  those  automatic  fail-safes,  operators 
would  need  to  shut  down  all  affected  equipment  to  avoid 


10.  With  the  introduction  of  competition  in  wholesale  markets — 
largely  because  of  federal  policy  initiatives — new  merchant  gener¬ 
ators  have  emerged  that  are  not  subject  to  rate-of-return  regula¬ 
tions,  and  utilities  have  had  strong  incentives  to  divest  generation 
capacity  to  avoid  rate-of-return  regulations,  too.  In  some  states, 
utilities  have  sold  off  additional  generation  capacity  as  a  part  of 
local  initiatives  to  restructure  retail  markets.  Elowever,  utilities 
that  still  own  generation  facilities  as  part  of  their  vertically  inte¬ 
grated  systems  and  all  of  the  federal  power  agencies  continue  to 
base  their  wholesale  prices  on  operating  costs  plus  a  return  on  cap¬ 
ital.  Eor  transmission  services,  the  federal  government  ensures  that 
all  utilities  receive  their  costs  and  a  fair  rate  of  return,  but  individ¬ 
ual  purchasers  of  transmission  services  may  pay  more  than  that 
cost,  depending  on  local  congestion. 
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damage.)  The  NERC  also  has  developed  detailed  guide¬ 
lines  that  may  help  protect  the  electric  power  sector  from 
physical  and  electronic  attacks. 

Ideas  for  New  Approaches 
to  Reliable  Electricity  Service 

A  terrorist  attack  (or  another,  more  common  cause  of 
power  loss)  that  disrupted  electricity  supplies  would  be 
likely  to  impose  social  costs  on  the  public  in  addition  to 
those  faced  by  the  providers  and  direct  purchases  of  that 
power.  Private  costs  would  be  borne  by  the  owners  of  the 
generators,  transmission  lines,  or  control  centers  that 
were  the  immediate  target  of  such  an  attack  and  by  their 
electricity  customers  who  lost  power  for  any  period  of 
time.  Those  private  costs  include  the  value  of  equipment 
damaged  in  the  attack  and  lost  sales  from  the  interrup¬ 
tion  of  power.  Society’s  costs  would  encompass  other 
power  suppliers  (and  their  customers)  affected  by  cascad¬ 
ing  system  problems  but  not  directly  doing  business  with 
the  targeted  utility.  Total  costs  would  include  the  incon¬ 
venience  or  threats  to  safety  for  everyone  dependent  on 
the  goods  and  services  that  the  direct  electricity  custom¬ 
ers  provide — for  example,  residents  of  high-rise  build¬ 
ings,  customers  of  retail  gasoline  outlets,  or  communities 
that  rely  on  water  treatment  systems  and  certain  emer¬ 
gency  services. 

In  general,  electricity  suppliers  do  not  see  the  full  social 
benefits  from  spending  to  increase  reliability  or  are  not 
able  to  fully  profit  from  their  efforts.  For  that  reason, 
there  is  general  recognition  that  government  has  an  im¬ 
portant  role  to  play  in  promoting  efforts  to  make  electric¬ 
ity  service  more  reliable  and  increase  consumers’  ability  to 
endure  interruptions.  Many  of  the  options  described  here 
have  been  considered  as  a  part  of  several  comprehensive 
energy  bills  introduced  in  past  Congresses — independent 
of  any  concerns  about  homeland  security.  For  example, 
the  Energy  Policy  Act  of  2003  would  have  required  the 
Federal  Energy  Regulatory  Commission  to  establish  sev¬ 
eral  new  rules  for  managing  the  nation’s  electricity  system 
and  governing  the  electricity  industry’s  business  prac¬ 
tices.^^  Such  rules  would  affect  transmission  services, 
construction  and  siting  permits  for  new  transmission 


1 1 .  See  North  American  Electric  Reliability  Council,  Security  Guide¬ 
lines  for  the  Electric  Sector  (June  14,  2002),  available  at  www. 
esisac.com/publicdocs/Guides/SecurityGuidelinesElectricity 
Sector- Versionl  .pdf. 


lines  and  the  reliability  of  the  nation’s  electricity  transmis¬ 
sion  infrastructure.^^ 

Internalizing  the  Costs  of  Power  Losses 

Policies  that  would  lead  the  electricity  industry  to  inter¬ 
nalize  more  of  the  social  costs  of  potential  attacks  could 
include  fiscal  incentives  and  regulatory  changes  that 
caused  utilities  to  further  improve  their  response  to  a  loss 
of  key  facilities  or  that  helped  reduce  general  economic 
losses  by  making  utilities  and  power  consumers  less  reli¬ 
ant  on  particular  sources  of  supply. 

For  example,  to  improve  preparations  for  the  threat  of  an 
attack  on  any  one  critical  piece  of  equipment,  such  as  a 
high-voltage  transformer,  utilities  could  be  required  to 
hold  larger  inventories  of  those  critical  spare  parts  (or  per¬ 
haps  establish  a  national  stockpile).  Another  option 
would  be  to  standardize  the  design  of  critical  spare  parts 
to  increase  the  use  of  existing  local  inventories  in  re¬ 
sponding  to  attacks  elsewhere  in  the  country.  Also,  al¬ 
though  the  costs  of  hardening  defenses  for  the  nation’s 
transmission  system  may  far  exceed  the  benefits  of  avoid¬ 
ing  an  attack  on  any  part  of  the  system,  opportunities 
may  exist  to  physically  protect  certain  key  pieces  of 
equipment.^'*  For  instance,  because  there  are  relatively 
few  high-voltage  transformers  that  step  down  power  to 
serve  the  nation’s  largest  cities,  protecting  those  impor¬ 
tant  substations  against  light  attacks  may  be  cost-effec¬ 
tive. 

Introducing  Competition.  Introducing  competition  into 
both  wholesale  and  retail  markets  for  electricity  has  been 
a  goal  of  federal  law  and  regulation  for  almost  30  years. 
Competition  has  occurred  to  some  extent  in  the  whole¬ 
sale  markets,  and  security  concerns  may  reinforce  the  case 
for  continuing  on  that  path.  Specifically,  introducing 
competition  from  additional  power  sources  could  further 
reduce  losses  from  a  successful  attack  by  making  it  easier 


12.  S.  I4,  108th  Cong.  (2003).  See  Congressional  Budget  Office, 
Cost  Estimate  for  S.  I4,  Energy  Policy  Act  of 2003  (May  7,  2003). 

13.  For  a  discussion  of  some  options  directly  relevant  to  the  vulnera¬ 
bility  of  electric  power  control  systems,  see  Congressional 
Research  Service,  Critical  Infrastructure. 

14.  For  a  discussion  of  why  hardening  the  transmission  system’s 
defenses  may  not  be  the  best  strategy  to  pursue,  see  Alexander  E. 
Farrell,  Lester  B.  Lave,  and  Granger  Morgan,  “Bolstering  the 
Security  of  the  Electric  Power  System,”  Issues  in  Science  and  Tech¬ 
nology  (Spring  2002),  available  at  www.issues.org/issues/ 18.3/ 
farrell.html. 
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for  utilities  to  replace  lost  power  and  by  giving  regional 
systems  more  flexibility  in  achieving  a  balance  of  genera¬ 
tion  and  load.  In  addition,  customers  would  be  better 
able  to  choose  suppliers  on  the  basis  of  reliability  or  to 
switch  to  other  power  sources  during  a  disruption.  Fur¬ 
ther,  increased  competition  could  better  align  electricity 
prices  with  scarcity,  giving  consumers  and  businesses 
greater  incentives  and  capabilities  to  switch  to  less  costly 
sources  of  supply.  Competition  could  also  allow  cus¬ 
tomers  who  placed  a  particularly  high  value  on  reliability 
to  invest  in  their  own  backup  generation  or  contract  with 
local,  off-grid  suppliers — thus  enabling  them  to  switch  to 
other  power  sources  during  a  disruption  of  the  main  sup¬ 
ply. 

More  sources  of  supply  would  mean  greater  reliability  in 
the  face  of  disruptions  to  any  one  of  those  sources.  But 
competing  sources  of  electricity  supply — such  as  neigh¬ 
boring  utilities,  merchant  generators,  and  industrial  co¬ 
generators — may  need  federal  legislation  to  overcome 
regulatory  impediments  to  expanding  their  markets.  Such 
impediments  come  from  regulations  that  establish  who 
can  buy  and  sell  power  at  competitive  rates,  restrict  the 
addition  of  transmission  lines  and  regional  planning  in 
general,  restrict  connection  of  new  suppliers  to  local 
grids,  and  limit  consumers’  ability  to  add  generation  ca¬ 
pacity.  Adding  transmission  capacity  may  be  especially 
important  to  increasing  competition — whether  by  adding 
new  lines  or  improving  the  management  of  existing  sys¬ 
tems. 

Local  Versus  Regional  Regulation.  Regulatory  obstacles 
to  protecting  the  supply  of  electricity  are  complex.  Be¬ 
cause  of  the  network  design  of  the  regional  grid  and  the 
interdependence  of  local  supply  systems,  new  spending 
on  transmission  links  or  activities  to  directly  protect 
equipment  in  one  local  system  would  help  protect  sup¬ 
plies  regionwide.  But  local  regulators  might  be  reluctant 
to  approve  rate  hikes  to  cover  spending  that  did  not  ex¬ 
clusively  benefit  their  local  consumers.  And  more  imme¬ 
diately,  local  utilities  might  be  reluctant  to  take  actions 
that  could  protect  regional  supplies — such  as  shedding 
load  to  help  preserve  system  balance — if  they  did  not  re¬ 
ceive  compensation  for  lost  sales.  One  possible  solution 
to  those  problems  is  to  transfer  authority  for  approving 


15.  A  discussion  of  problems  in  implementing  increased  competition 
appears  in  Paul  L.  Joskow,  The  Difficult  Transition  to  Competitive 
Electricity  Markets  in  the  US.  (Washington,  D.C.:  AEI-Brookings 
Joint  Center  for  Regulatory  Studies,  July  2003),  available  at 
www.aei.brookings.org/admin/authorpdfs/page.php?id=271. 


new  transmission  lines  or  other  changes  related  to  re¬ 
gional  reliability  from  local  regulators  to  regional  authori¬ 
ties  that  would  focus  more  on  systemwide  effects. 

Other  restrictions  on  competition  make  it  difficult  for  lo¬ 
cal  customers  to  choose  suppliers  on  the  basis  of  reliabil¬ 
ity  or  to  develop  capacity  to  switch  to  other  power 
sources  during  a  disruption.  Consumers  continue  to  face 
obstacles  to  installing  their  own  generating  devices,  al¬ 
though  such  home-  and  business-based  power  would  be 
likely  to  enhance  regional  reliability.^*^ 

Despite  the  difficulty  of  devising  fully  competitive  mar¬ 
kets  for  wholesale  and  retail  power,  several  options  related 
to  market  restructuring  exist  that  might  help  internalize 
social  costs  that  could  otherwise  result  from  service  dis¬ 
ruptions.  Those  options  include: 

■  Establishing  a  structure  for  wholesale  markets  for  elec¬ 
tricity  (and  for  ancillary  services)  that  would  reduce 
barriers  to  entry  for  new  suppliers  and  help  improve 
incentives  for  regional  coordination  in  areas  of  the 
country  where  such  markets  do  not  exist. 

■  Requiring  planning  over  broader  regions  (whether  by 
private  entities  independent  of  the  utilities  or  by  gov¬ 
ernment  agencies)  for  generation  and  transmission  ca¬ 
pacity  to  reduce  system  vulnerability,  funded  by  fees 
on  all  regional  suppliers.  (Such  planning  organizations 
would  have  authority  over  local  public  utility  commis¬ 
sions  and  publicly  owned  utilities  and  merchant  gen¬ 
erators  that  are  not  subject  to  PUC  jurisdiction.) 

■  Requiring  all  suppliers  (utilities  and  nonutilities)  to 
build  greater  redundancy  into  regional  systems  by 
constructing  whatever  generating  and  transmission 
capacity  is  called  for  in  the  regional  plans. 

■  Improving  real-time  management  of  regional  power 
grids  to  further  increase  the  system’s  flexibility  to  man¬ 
age  disruptions  (either  by  placing  more  decisionmak¬ 
ing  authority  about  generation  and  load-shedding 
with  operators  of  the  regional  transmission  systems  or 
by  improving  the  availability  of  information  on 
emerging  supply  constraints  to  help  local  utilities 
make  decisions). 


16.  For  a  discussion  of  regulatory  obstacles  to  distributed  generation, 
see  Congressional  Budget  Office,  Prospects  for  Distributed  Electric¬ 
ity  Generation  (September  2003). 
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Concerning  the  options  for  regional  planning  and  real¬ 
time  management,  one  approach  could  be  to  give  the 
North  American  Electric  Reliability  Council  regulatory 
authority  to  establish  and  enforce  clear  standards  for  util¬ 
ities  on  available  reserves.  Another  approach  could  be  to 
give  regional  operators  the  ability  to  issue  orders  to  tem¬ 
porarily  reduce  the  supply  to  some  consumers  (or  shed 
load)  as  a  precondition  for  connection  to  regional  power 
grids.  And  the  Federal  Energy  Regulatory  Commission 
could  be  given  authority  to  direct  the  construction  of  ad¬ 
ditional  transmission  lines  and  to  set  conditions  for 
wholesale  markets  that  would  enable  more  suppliers  to 
participate. 

Increasing  Customers’  Flexibility.  One  option  to  increase 
electricity  customers’  flexibility  to  respond  to  disruptions 
would  be  to  require  retail  utilities  to  promote  diversity  of 
energy  and  power  sources  for  their  customers  (including 
providing  a  choice  of  suppliers).  To  be  most  effective, 
such  diversity  would  need  to  reflect  an  addition  to  the 
generating  capacity  anywhere  it  might  be  needed  (to 
overcome  constraints  on  transmission),  an  increase  in  the 
number  of  different  suppliers  (to  overcome  constraints  on 
individual  suppliers),  or  an  increase  in  the  types  of  energy 
sources  for  generating  power  (to  overcome  constraints  on 
supplies  of  individual  fuels  for  generating  power).  One 
approach  to  help  achieve  that  diversity  would  be  to  re¬ 
move  technical,  contractual,  and  pricing  impediments 
that  discourage  consumers  from  investing  in  distributed 
power  (for  homes  and  businesses)  and  cogeneration  (es¬ 
pecially  for  critical  industries). 

In  addition,  the  current  system  of  average-cost  pricing 
can  undermine  consumers’  incentives  to  reduce  power 
use  at  critical  times,  thus  weakening  system  reliability. 
One  possible  response  would  be  to  implement  real-time, 
marginal-cost  pricing  at  the  retail  level,  with  consumers 
free  to  choose  providers.  The  resulting  prices  would  more 
fully  reflect  the  scarcity  of  supply,  so  that  any  power  dis¬ 
ruptions  would  lead  to  higher  prices — ^which  in  turn 
would  lead  some  consumers  not  affected  by  shortages  to 
reduce  their  use.  For  disruptions  that  lasted  long  enough 
for  the  price  signals  to  reach  consumers,  the  reduction  in 
power  use  by  some  would  make  additional  power  avail¬ 
able  where  it  was  needed  most. 

Need  for  Backup  Generators.  One  problem  for  the  mar¬ 
ket  is  that  many  of  the  people  who  rely  on  electricity  are 
not  the  direct  purchasers — for  instance,  people  who  live 
in  high-rise  buildings,  take  the  subway,  or  depend  on 


community  and  business  services  that  require  reliable 
electricity.  Many  critical  services,  such  as  hospitals,  al¬ 
ready  maintain  their  own  generators  as  a  backup  source 
of  electricity.  And  under  local  building  codes,  most  high- 
rises  are  required  to  have  them,  too.  But  the  August  2003 
blackout  demonstrated  that  many  high-rises  in  New  York 
City  had  no  working  backup  systems.  Traffic  gridlock  en¬ 
sued  because  traffic  lights  did  not  work;  people  ran  out  of 
gas  in  idling  cars,  and  service  stations  were  unable  to  refill 
gas  tanks.  In  several  cities,  the  absence  of  backup  power  at 
water  and  sanitation  facilities  for  even  a  brief  period  jeop¬ 
ardized  the  safety  of  drinking  water  for  weeks.  That  sce¬ 
nario  suggests  the  establishment  of  national  building 
codes  to  require  the  presence  of  emergency  backup  gener¬ 
ators  for  high-rise  buildings,  electricity-powered  subways, 
traffic  lights,  gasoline  stations,  and  critical  public  func¬ 
tions  such  as  water  treatment. 

Socializing  the  Costs  of  Power  Losses 

It  may  be  cost-effective  to  federalize  some  supply  activi¬ 
ties,  such  as  transmission,  or  to  make  regional  planning  a 
government  activity.  Options  that  would  socialize  the 
costs  of  power  losses  attributable  to  terrorism  (or  other 
causes)  include: 

■  Establishing  fiscal  incentives  for  utilities  to  remove 
constraints  on  regional  power  systems — for  example, 
by  supporting  construction  of  additional  generating 
units  (possibly  driven  by  different  fuels)  or  new  trans¬ 
mission  lines  in  markets  that  have  little  diversity  of 
supply. 

■  Compensating  local  utilities  for  their  stranded  costs 
attributable  to  new  competition.  (Stranded  costs  are 
investments  by  the  utilities  that  cannot  be  paid  off  be¬ 
cause  of  regulatory  changes  that  undermine  the  utili¬ 
ties’  revenue  base.) 

■  Establishing  fiscal  incentives  for  new  investments  in 
distributed  power  (in  homes  and  businesses)  and  co¬ 
generation  (in  critical  industries),  especially  in  markets 
where  there  is  no  choice  among  electricity  suppliers. 

Improving  Information 

Security  efforts  can  be  enhanced  if  suppliers  and  custom¬ 
ers  have  more-complete  information  on  the  extent  of  a 
current  power  loss  or  their  vulnerability  to  future  losses. 
With  changes  in  the  structure  of  electricity  markets, 
transmission  systems  must  now  move  power  for  more 
generators  and  to  more  communities  than  they  originally 
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were  designed  for.^^  And  the  communities  that  purchase 
bulk  power  do  not  always  know  where  their  power  is 
coming  from  or  by  what  routes.  Several  options  to  ad¬ 
dress  that  information  gap  include: 

■  Requiring  utilities  or  transmission-system  operators  to 
prepare  vulnerability  assessments  that  would  indicate 
facilities  where  the  need  for  additional  capacity  or  a 
hardening  of  defenses  was  greatest. 


17.  For  a  discussion  of  information  needs  in  the  transmission  sector, 
see  Department  of  Energy,  Energy  Information  Administration, 
Electricity  Transmission  in  a  Restructured  Industry:  Data  Needs  for 
Public  Policy  Analysis,  DOE/EIA-0639  (December  2004). 


■  Establishing  market-based,  real-time  prices  in  the 
wholesale  markets  for  electricity  to  help  convey  better 
information  about  the  potential  for  losses. 

■  Requiring  operators  to  install  additional  sensors  and 
telemetry  to  provide  detailed,  real-time  information 
on  power  flows  at  all  points  within  the  regional  grids 
and  between  grids. 

■  Collecting  and  disseminating  additional  national  in¬ 
formation  indicating  potential  supply  constraints  and 
system  weaknesses  and  improving  the  display  of 
power-flow  information. 


CHAPTER 


5 

Food  and  Agriculture 


R 

H  Beports  of  terrorist  groups’  interests,  as  well  as  the 
history  of  events  involving  food  contamination  and  the 
use  of  biological  agents,  support  concerns  about  the  pros¬ 
pect  of  terrorist  attacks  on  the  food  and  agriculture  in¬ 
dustry.  ^  The  industry  would  be  vulnerable  to  attack  be¬ 
cause  of  the  large  numbers  of  food  items  and  the  many 
points  of  access.  However,  many  of  those  vulnerabilities 
are  already  addressed  through  extensive  regulation  put  in 
place  before  September  1 1  in  response  to  the  nation’s 
continuing  concerns  about  food  safety.  That  regulation 
and  the  organization  of  the  nation’s  public  health  system 
would  help  limit  the  losses  from  any  attacks  on  food  sup¬ 
plies  involving  a  range  of  known  agents.  The  greatest 
concern  would  be  threats  that  could  escape  or  exceed  the 
nation’s  current  detection  capabilities  or  for  which  an  ef¬ 
fective  response  would  require  an  increased  level  of  coor¬ 
dination  among  agencies  and  different  levels  of  govern¬ 
ment. 

Vulnerabilities  from  Contamination, 
Loss  of  Food  Sources,  and  Use  of 
Agricultural  Resources  as  Weapons 

The  use  of  natural  agents  in  attacks  on  agriculture  or  di¬ 
rectly  on  people  is  commonly  described  as  bioterrorism. 
That  term  would  include  biological  attacks — such  as  with 
Bacillus  anthracis  (anthrax)  and  smallpox — that  might 
not  involve  farms  and  food  but  would  require  some  of  the 
same  protective  measures  and  emergency  responses.  The 
security  of  drugs  and  drinking  water  supplies  is  a  particu- 


1 .  For  a  discussion  of  the  threat  to  food  supplies,  see  Food  and  Drug 
Administration,  Risk  Assessment  for  Food  Terrorism  and  Other  Food 
Safety  Concerns  fOctober  13,  2003),  available  at 
www.cfsan.fda.gov/-dms/rabtact.html.  For  a  discussion  of  the 
threat  to  crops  and  livestock,  the  economic  implications,  and 
some  policy  ideas  for  countering  that  threat,  see  Congressional 
Research  Service,  Agroterrorism:  Threats  and  Preparedness,  CRS 
Report  for  Congress  RL32521  (August  13,  2004). 


larly  important,  related  concern.  And  although  the  main 
focus  of  attention  in  the  event  of  a  biological  attack 
would  be  on  the  immediate  safety  of  the  food  supply, 
much  of  the  value  of  the  industry’s  output  is  in  areas  such 
as  forest  products,  fibers,  and  other  products  that  are  not 
related  to  food — and  those  nonfood  resources  could  be 
threatened  as  well. 

Types  of  Attacks 

The  food  and  agriculture  industry  is  vulnerable  to  four 
types  of  assaults: 

■  Contamination  of  food  with  natural  biological  agents, 
such  as  Clostridium  botulism  toxin  (botulism)  and  Es¬ 
cherichia  coli  bacteria  (E.  coli); 

■  Contamination  of  food  with  man-made  contami¬ 
nants,  such  as  poisonous  minerals  or  chemicals  and 
foreign  objects; 

■  Attacks  to  disrupt  food  supplies,  including  the  use 
of  fires,  floods,  or  biological  agents  such  as  foot-and- 
mouth  disease  or  insects;  and 

■  Use  of  agricultural  resources  as  weapons  for  attacks  on 
other  targets,  such  as  wildfires  that  spread  to  residen¬ 
tial  areas,  nitrate  fertilizer  for  use  in  explosives,  pesti¬ 
cides  for  poisoning,  crop  dusters  to  spread  toxins,  or 
radioactive  materials  used  in  food  irradiation. 

The  Food  and  Drug  Administration  (FDA)  has  identified 
several  specific  hazards  to  the  safety  of  food  supplies.^ 
Among  the  biological  hazards,  the  deadly  pathogens  an¬ 
thrax  and  botulism  are  considered  the  greatest  dangers. 
Next  are  salmonella,  pathogenic  strains  of  E.  coli,  and  ri- 


2.  Food  and  Drug  Administration,  Risk  Assessment  for  Food  Terrorism 
and  Other  Food  Safety  Concerns  (October  13,  2003),  available  at 
www.cfsan.fda.gov/-dms/rabtact.html. 
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cin.  Among  the  man-made  contaminants  that  present  a 
threat,  FDA  has  noted  concerns  about  heavy  metals  (such 
as  lead  and  mercury),  pesticides,  dioxins,  and  other  sub¬ 
stances  that  could  be  introduced  into  the  food  supply. 

Potential  Weaknesses  in  Defenses 

The  vulnerability  to  extensive  losses  would  be  relatively 
small  if  a  disease  or  contaminant  maliciously  introduced 
into  the  food  supply  was  one  with  which  the  industry  had 
experience.  The  government  tests  for  the  most  common 
diseases  and  requires  that  outbreaks  of  many  diseases 
(whether  in  plants  and  animals  or  in  the  human  popula¬ 
tion)  be  reported.  As  a  result,  it  is  likely  that  an  attack 
would  be  detected  early,  traced  to  its  source,  treated,  and 
contained. 

Losses  could  be  significantly  higher  if  the  attacks  involve 
substances  that  can  enter  the  supply  chain  at  a  point  be¬ 
fore  or  after  which  their  origins  cannot  be  traced,  sub¬ 
stances  that  are  not  tested  for,  and  pathogens  or  contami¬ 
nants  with  which  government  inspectors  or  health 
professionals  have  little  experience.  Tests  may  not  be 
available  to  detect  certain  agents  within  foods,  and  peo¬ 
ple’s  exposure  to  such  substances  may  not  be  recognized 
or  reported  to  appropriate  state  or  national  organizations 
to  discern  a  pattern  of  assault  or  initiate  a  response.  Fur¬ 
ther,  detection  of  and  response  to  new  modes  of  attack 
may  require  an  increased  level  of  coordination  among  dif¬ 
ferent  federal  agencies  and  between  different  levels  of 
government. 

For  example,  the  Department  of  Agriculture  (USDA) 
tests  many  meat  products  for  E.  coli  and  salmonella,  but 
it  does  not  routinely  test  food  supplies  for  contamination 
from  anthrax  or  ricin.  Records  are  kept  on  animals,  poul¬ 
try,  and  eggs  that  enable  USDA  to  trace  the  source  of 
contaminants  back  through  much  of  the  supply  chain. 
But  after  meats  are  delivered  to  meat  processing  centers, 
for  example,  there  is  no  way  to  distinguish  what  herds  (or 
animals  from  specific  regions  or  countries)  went  into 
what  batches  of  meat  products  for  subsequent  delivery  to 
stores.  The  Food  and  Drug  Administration  also  requires 
random  testing  of  many  food  products  (in  processing  and 
packing  facilities  and  in  transit)  for  certain  contaminants. 
Fdowever,  for  food  products,  FDA  currently  requires  only 
that  lot  numbers  (for  tracking  purposes)  be  placed  on  in¬ 
fant  formula  and  low-acid  canned  food. 


Terrorists’  Intent  and  Past  Incidents 

Terrorist  groups  reportedly  have  shown  interest  in  ex¬ 
ploiting  weaknesses  in  the  nation’s  food  and  agriculture 
industry,  although  little  information  on  that  threat  is 
publicly  available.  The  al  Qaeda  terrorist  group  is  known 
to  have  considered  using  crop  duster  aircraft,  apparently 
with  the  intent  of  distributing  toxins  or  pathogens  over 
crops  and  populated  areas.  Members  of  a  related  group 
were  arrested  in  London  for  trying  to  manufacture  the 
deadly  poison  ricin — a  product  of  castor  beans. 

The  number  of  publicly  documented  crimes  intended  to 
harm  people  or  disrupt  supplies  is  small.  Fdowever,  many 
of  those  assaults  confirm  the  potential  for  serious  health 
and  economic  consequences.  For  example,  efforts  by  a 
religious  cult  in  Oregon  to  contaminate  local  salad  bars 
with  salmonella  in  1984  affected  750  people.  Other  inci¬ 
dents  of  food  sabotage  are  more  commonly  perpetrated 
by  disgruntled  employees  and  affect  only  a  few  people. 
But  the  consequences  can  be  more  widespread  than  the 
direct  numbers  harmed,  as  illustrated  in  the  1 982  case  of 
cyanide-tainted  Tylenol  capsules.  The  immediate  effect 
was  seven  deaths,  but  the  resulting  publicity  caused  a 
near-total  collapse  in  national  demand  for  that  product 
and  led  to  at  least  five  imitation  attacks  in  subsequent 
years,  all  involving  fatalities.^ 

Potential  Losses  from  Threats 
to  Health  or  Consumers’  Aversion 
to  Contaminated  Products 

The  immediate  consequences  of  a  terrorist  attack  on  food 
and  agriculture  may  be  illness  or  the  loss  of  life,  depend¬ 
ing  on  the  nature  of  the  attack  and  how  quickly  it  is  de¬ 
tected.  With  the  important  exception  of  several  food- 
borne  outbreaks  affecting  many  thousands,  the  numbers 
of  people  seriously  harmed  by  individual  incidents 
(whether  by  accident  or  intent)  have  been  small,  at  least 
in  part  because  of  current  regulations  and  the  success  of 
the  nation’s  public  health  system  in  containing  outbreaks 
and  limiting  losses.  As  a  result,  the  costs  of  a  terrorist  at¬ 
tack  may  be  related  more  to  business  losses  than  human 
losses.  Much  of  the  economic  cost  would  result  from  the 
increased  costs  of  replacing  lost  supplies.  That  cost  might 


3.  Those  acts  were  the  poisonings  of  Lipton  Cup-A-Soup  in  1986, 
Excedrin  in  1986,  Tylenol  again  in  1986,  Sudafed  in  1991,  and 
Goody’s  Headache  Powder  in  1992. 
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be  small  for  the  nation  but  could  differ  among  regional 
economies. 

Losses  from  Accidental  Contaminations 

Past  incidents  involving  accidental  contaminations  of  the 
food  supply  indicate  the  potential  health  consequences  of 
an  attack  and  underscore  the  importance  of  current  food 
safety  regulations  and  public  health  institutions.  Re¬ 
searchers  at  the  Centers  for  Disease  Control  and  Preven¬ 
tion  estimate  that  76  million  illnesses,  325,000  hospital¬ 
izations,  and  5,000  deaths  occur  every  year  because  of 
contaminated  food.^  Specific  incidents  point  to  how 
widespread  a  contamination  can  become  if  not  detected 
quickly.  About  170,000  people  were  sickened  by  salmo¬ 
nella  typhimurium  in  milk  from  a  U.S.  dairy  plant,  and 
224,000  people  were  sickened  by  salmonella  enteritidis 
linked  to  ice  cream.  ^ 

Economic  costs  associated  with  those  threats  to  health 
and  safety  can  be  significant.  For  example,  USDA  esti¬ 
mates  that  the  annual  cost  to  the  nation — in  terms  of 
medical  costs,  productivity  losses,  and  costs  of  premature 
deaths — from  five  major  foodborne  pathogens  totals  $6.9 
billion.'^ 

Why  Economic  Consequences  Might  Be  Small 

Retail  sales  by  food  and  beverage  stores  (including  grocer¬ 
ies)  were  more  than  $505  billion  in  2003,  and  agricul¬ 
tural  exports  were  valued  at  more  than  $59  billion.^ 
However,  those  types  of  aggregate  measures  of  the  value 
of  annual  sales  or  output  are  likely  to  overstate  the  poten- 


4.  Paul  S.  Mead  and  others,  “Food-Related  Illness  and  Death  in  the 
United  States:  Reply  to  Dr.  Halberg,”  Emerging  Infectious  Diseases, 
vol.  5,  no.  6  (November-December  1999). 

5.  Food  and  Drug  Administration,  Risk  Assessment  for  Food  Terrorism 
and  Other  Food  Safety  Concerns.  Other  examples  of  foodborne  out¬ 
breaks,  intentional  and  unintentional,  appear  in  FDA,  Notice  of 
Proposed  Rulemaking,  Federal  Register,  vol.  68,  no.  90  (May  9, 
2003),  p.  25187. 

6.  Department  of  Agriculture,  Economic  Research  Service,  “Eco¬ 
nomics  of  Foodborne  Disease,”  available  atwww.ers.usda.gov/ 
briefmg/FoodborneDisease/features.htm. 

7.  Sales  data  for  2003  are  from  Bureau  of  the  Census,  Annual  Bench¬ 

mark  Report  for  Retail  Trade  and  Food  Services:  January  1992 
Through  February  2004  (March  2004),  Table  2,  available  at 
www.census.gov/prod/2004pubs/br03-a.pdf  Export  data  for 
2003  are  from  Department  of  Agriculture,  for  U.S.  Agri¬ 

cultural  Trade,  AES-4  (November  22,  2004),  available  at 
usda.mannlib.cornell.edu/reports/erssor/trade/aes-bb/2004/ 
aes44.pdf 


dal  economic  cost  to  the  nation  of  disrupting  the  indus¬ 
try.  It  is  difficult  to  imagine  how  all  food  supplies  could 
be  affected  or  even  how  the  total  supply  of  any  basic  food 
source  could  be  affected  for  a  significant  amount  of  time. 
Replacement  supplies  (from  storage  or  from  unaffected 
regions)  and  very  close  substitutes  (from  the  perspective 
of  consumer  welfare)  are  readily  available  for  virtually  ev¬ 
ery  type  of  food  product.  People  could  draw  on  current 
inventories  of  the  targeted  item  (in  home  and  stores), 
stop  consuming  any  particular  food  item  altogether,  stay 
away  from  food  from  a  particular  agricultural  region,  or 
not  frequent  a  given  grocery  chain  or  fast-food  outlet.  For 
the  nation  as  a  whole,  the  sales  lost  by  products  or  estab¬ 
lishments  that  were  directly  affected  by  an  attack  would 
be  made  up  in  increased  sales  elsewhere. 

The  cost  to  the  national  economy  would,  for  the  most 
part,  be  the  increase  in  the  cost  of  supplying  those  re¬ 
placements  or  substitutes  (and  the  loss  in  consumer  satis¬ 
faction).  For  a  number  of  reasons,  even  that  residual  cost 
should  be  small.  First,  the  food  and  agriculture  industry  is 
well  adapted  to  the  prospect  of  disruptions  from  weather 
and  occasional  health  incidents.  For  example,  in  anticipa¬ 
tion  of  periodic  crop  losses,  the  most  vulnerable  crops  are 
often  grown  in  multiple  regions,  and  individual  farmers 
diversify  their  plantings  and  purchase  crop  insurance. 
Similarly,  food  distributors  and  grocers  already  have  expe¬ 
rience  with  identifying  and  recalling  contaminated  lots. 
Second,  government  programs  are  in  place  to  ensure  food 
safety  (and  limit  the  health  consequences  of  an  attack) 
and  to  sustain  the  income  of  some  agricultural  producers 
(and,  indirectly,  the  businesses  and  regions  that  depend 
on  them).  As  a  result,  the  economic  effects  of  a  terrorist 
incident  might  well  fall  within  the  realm  of  industry  ex¬ 
perience  and  current  public  plans  for  detection  and  re¬ 
sponse. 

Cases  in  Which  Economic  and 
Societal  Costs  Would  Be  Highest 

Circumstances  could  exist,  however,  in  which  the  cost  of 
replacement  would  be  high  or  the  cost  to  society  would 
be  greater  than  the  immediate  loss  associated  with  any  re¬ 
placement  or  substitution  for  lost  supplies.  For  example, 
replacement  costs  could  be  greater  than  otherwise  if  there 
was  a  high  market  concentration  in  the  targeted  food  or 
agriculture  industry.  Where  only  one  or  a  few  businesses 
account  for  a  large  share  of  sales,  the  opportunities  for 
drawing  on  inventories  or  switching  to  other  suppliers 
may  be  limited.  Also,  in  some  cases  of  contamination,  the 
costs  of  replacing  lost  supplies  may  entail  more  than  sim- 
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ply  ramping  up  production.  For  some  diseases,  there  may 
be  few  options  to  eliminate  the  risk  of  further  contamina¬ 
tion  other  than  burning  facilities,  plants,  and  livestock. 

The  cost  to  society  would  be  greater  than  the  direct  losses 
associated  with  replacement  and  substitution  if  there  were 
noneconomic  losses  to  consider.  For  example,  if  the  at¬ 
tack  resulted  in  a  major  forest  fire,  costs  could  include  the 
loss  of  recreational  benefits,  erosion  from  damaged  water¬ 
sheds,  and  loss  of  wildlife — values  that  can  be  difficult  to 
express  in  dollar  terms.  And  attacks  involving  pesticides 
or  other  toxins  could  cause  environmental  damage. 

Regardless  of  the  economic  cost  to  the  nation,  the  poten¬ 
tial  loss  for  the  particular  producers  or  regional  econo¬ 
mies  could  be  significant.  For  example,  in  seven  states, 
farm  employment  accounts  for  more  than  5  percent  of 
the  total  state  work  force.  ^  The  nature  of  many  agricul¬ 
tural  commodities  is  that  they  are  produced  in  discrete 
growing  seasons:  once  the  current  supply  is  lost,  the  do¬ 
mestic  market  has  to  wait  through  a  new  cycle. 

Other  Long-Term  Effects  on  Businesses 

Broad  consumer  concerns  about  the  safety  of  food  sup¬ 
plies  can  have  other  adverse  economic  effects.  Any  public 
demonstration  of  vulnerability  to  attack  can  lead  to 
costly,  long-term  (if  not  permanent)  changes  in  product 
handling  and  consumer  demand.  The  Tylenol  case,  for 
instance,  led  to  requirements  for  tamper-resistant  packag¬ 
ing.  The  situation  with  mad  cow  disease,  although  not 
deriving  from  terrorism,  has  led  to  new  costs,  too — from 
having  to  discard  certain  animal  parts,  restrict  the  con¬ 
tents  of  animal  feed,  and  inspect  slaughtered  animals. 
Based  on  the  costs  to  beef  producers  in  Japan  for  inspect¬ 
ing  slaughtered  animals,  that  requirement  alone  could  en¬ 
tail  $1.2  billion  in  expenses  for  the  much  larger  U.S.  beef 
industry  if  applied  here.^  (Japan  spends  $40.9  million  a 
year  inspecting  only  about  1.3  million  slaughtered  cattle. 
The  United  States  slaughters  about  37  million  cattle 
annually.) 


8.  Percentages  for  2002  are  from  Bureau  of  Economic  Analysis  data 
on  farm  employment,  available  at  www.bea.doc.gov/bea/regional/ 
reis/ drill. cfm?table=CA25N&lc=70&years=2002, 200 1  &for- 
mat=htm&areatype=00000. 

9.  “Japan  Is  Strict  Model  for  Cow  Testing,”  Wall  Street  Journal, 
December  29,  2003. 


Current  Programs  for  Food  Safety 

The  U.S.  food  and  agriculture  industry  is  highly  regu¬ 
lated.^*'  Virtually  all  products  at  all  points  in  the  supply 
chain  are  regulated  to  some  degree  to  ensure  the  ultimate 
safety  of  the  food  supply  and  protect  the  agricultural 
economy.  The  principal  federal  regulatory  agencies  re¬ 
sponsible  for  providing  consumer  protection  are  FDA 
(part  of  the  Department  of  Fdealth  and  Fduman  Services), 
USDAs  Food  Safety  and  Inspection  Service  and  Animal 
and  Plant  Health  Inspection  Service,  and  the  Environ¬ 
mental  Protection  Agency.  Inspectors  from  the  Depart¬ 
ment  of  Homeland  Security’s  Bureau  of  Customs  and 
Border  Protection  assist  other  agencies  by  checking  im¬ 
ports.  (Further  controls  come  from  state  and  local  regula¬ 
tions.  All  states  conduct  safety  inspections  of  food  pro¬ 
cessing  plants.  Some  states,  such  as  California,  have 
programs  that  restrict  certain  agricultural  imports  or  that 
call  for  inspections  of  agricultural  shipments.) 

Federal  Programs 

FDA  is  charged  with  protecting  consumers  against  im¬ 
pure,  unsafe,  and  fraudulently  labeled  foods.  It  has  regu¬ 
latory  authority  over  about  80  percent  of  the  nation’s 
food  supply,  including  seafood,  canned  goods,  and  other 
products  that  are  defined  as  “food”  in  the  Federal  Food, 
Drug,  and  Cosmetic  Act.  Many  substances  come  under 
FDA  jurisdiction  as  “food”  because  of  the  presence  of 
substances  or  chemicals  in  food  containers  or  other  food- 
contact  surfaces  that  can  leech  into  food  products. 

Generally,  only  meat,  poultry,  and  egg  products  fall  under 
the  direct  responsibility  of  other  agencies.  The  Food 
Safety  and  Inspection  Service  regulates  the  safety,  quality, 
and  labeling  of  most  meats,  as  well  as  poultry  and  egg 


10.  For  an  overview  of  federal  regulation,  see  the  interagency  paper  by 
the  Department  of  Agriculture  and  the  Food  and  Drug  Adminis¬ 
tration,  A  Description  of  the  U.S.  Food  Safety  System  (March  3, 
2000),  available  at  www.fsis.usda.gov/OA/codex/ system.htm.  For 
a  specific  discussion  of  FDA  and  USDA  regulation  at  food-pro- 
cessing  plants,  see  General  Accounting  Office,  Food-Processing 
Security,  GAO-03-342  (January  2003).  For  a  discussion  of  bioter¬ 
rorism  security  efforts  by  the  Department  of  Health  and  Human 
Services,  see  General  Accounting  Office,  FIHS  Bioterrorism  Pre¬ 
paredness  Programs,  GAO-04-360R  (February  10,  2004). 
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products.  EPA’s  mission  includes  protecting  public 
health  and  the  environment  from  risks  posed  by  pesti¬ 
cides  and  promoting  safer  means  of  pest  management. 

No  food  or  feed  item  may  be  marketed  legally  in  the 
United  States  if  it  contains  a  food  additive  or  drug  residue 
not  permitted  by  FDA  or  a  pesticide  residue  exceeding 
tolerance  level  established  by  EPA.  The  role  of  the  Ani¬ 
mal  and  Plant  Health  Inspection  Service  is  to  protect 
against  the  introduction  and  spread  of  plant  and  animal 
pests  and  diseases,  in  part  by  monitoring  countries  expe¬ 
riencing  outbreaks  of  foot-and-mouth  disease,  mad  cow 
disease,  and  other  diseases.  Those  agencies  also  use  exist¬ 
ing  food  safety  and  environmental  laws  to  regulate  plants, 
animals,  and  foods  that  are  the  products  of  biotech¬ 
nology. 

Many  other  agencies  have  food  safety  missions  within 
their  research,  education,  prevention,  surveillance,  stan¬ 
dard-setting,  and  outbreak-response  activities.  Within 
FDA  are  the  Center  for  Food  Safety  and  Applied  Nutri¬ 
tion  and  the  Center  for  Veterinary  Medicine.  Other  agen¬ 
cies  at  the  Department  of  Health  and  Human  Services  are 
the  Centers  for  Disease  Control  and  Prevention  and  the 
National  Institutes  of  Health  (which  identify  sources  and 
cures  for  food- related  illnesses),  and  other  offices  of  the 
Public  Health  Service  (which  help  prepare  hospitals  and 
health  professionals  for  responding  to  a  bioterrorist  at¬ 
tack).  Other  USDA  agencies  with  some  stake  in  food 
safety  are  the  Agricultural  Research  Service;  the  Coopera¬ 
tive  State  Research,  Education,  and  Extension  Service; 
the  Agricultural  Marketing  Service;  the  Economic  Re¬ 
search  Service;  the  Grain  Inspection,  Packers,  and  Stock- 
yard  Administration;  and  the  Food  and  Nutrition  Ser¬ 
vice.  At  the  Department  of  Commerce,  the  National 
Marine  Fisheries  Service  inspects  fish  processing  plants 
for  compliance  with  FDA  and  USDA  safety  regulations 
under  a  voluntary  industry  program. 

New  Policies  Since  September  11 

The  federal  policy  for  defending  the  food  and  agriculture 
system  against  terrorism,  disasters,  and  emergencies  was 
laid  out  in  January  2004  in  Homeland  Security  Presiden¬ 
tial  Directive-9.^^  The  Department  of  Health  and  Hu¬ 


11.  Products  subject  to  regulation  are  defined  in  the  Federal  Meat 
Inspection  Act,  the  Poultry  Products  Inspection  Act,  and  the  Egg 
Products  Inspection  Act. 

12.  The  Centers  for  Disease  Control  and  Prevention  provides  an  over¬ 
view  of  documents  and  activities  related  to  public  health  pre¬ 
paredness  at  www.bt.cdc.gov/planning/index.asp. 


man  Services,  USDA,  and  EPA  were  directed  to  increase 
their  efforts  in  the  areas  of  prevention,  surveillance,  emer¬ 
gency  response,  and  recovery.  Much  of  USDAs  effort  is 
grouped  in  its  Food  and  Agriculture  Defense  Initiative, 
including  its  program  to  direct  research  and  share  infor¬ 
mation  through  the  Food  Emergency  Response  Network 
— a  joint  effort  with  FDA  and  participating  state  labora¬ 
tories.^'^  In  addition,  the  Public  Health  Security  and  Bio¬ 
terrorism  Preparedness  and  Response  Act  of  2002  pro¬ 
vided  the  authority  for  new  regulations  to  improve  FDA’s 
ability  to  identify  domestic  and  foreign  facilities  that  pro¬ 
vide  food,  monitor  and  target  inspections  of  food  im¬ 
ports,  and  notify  food  processors  and  other  establish¬ 
ments  that  may  have  been  or  become  involved  in  the 
contamination  of  food  supplies.  Regulations  recently 
promulgated  under  the  authority  of  that  law  require  all 
businesses  in  the  chain  of  supply  to  maintain  records  that 
would  identify  the  immediate  previous  sources  and  im¬ 
mediate  subsequent  recipients  of  food  and  its  packag¬ 
ing.  Finally,  the  Project  BioShield  Act  of  2004  required 
new  measures  to  expand  and  expedite  the  availability  of 
vaccines  and  treatments  to  combat  potential  bioterrorism 
agents. 

Ideas  for  New  Approaches 
to  Food  and  Agriculture  Security 

Two  basic  problems  can  cause  the  social  losses  from  an  at¬ 
tack  on  food  supplies  to  be  greater  than  the  private  losses 
to  suppliers.  One  problem  is  that  most  food  products,  by 
the  time  they  reach  the  market,  cannot  be  distinguished 
by  their  source,  so  the  supplier  of  a  harmful  product  may 
bear  little  responsibility  for,  or  suffer  serious  economic 
loss  from,  its  adverse  effects.  That  situation  also  applies  to 
sellers  of  hazardous  agricultural  supplies,  such  as  nitrates 
or  pesticides,  that  can  be  used  in  attacks  elsewhere.  The 
other  problem  is  that  consumers  may  not  be  able  to  assess 
the  safety  of  their  food  and  suppliers  may  not  know  if 
they  are  starting  with  a  contaminated  product. 


13.  Available  at  www.whitehouse.gov/news/releases/2004/02/ 
20040203-2.html. 

14.  Information  on  the  budget  and  activities  of  the  Food  and  Agricul¬ 
ture  Defense  Initiative  is  available  at  www.usda.gov/agency/obpa/ 
Budget-Summary/2005/05. FoodandAgDefense.htm. 

15.  See  Food  and  Drug  Administration,  The  Bioterrorism  Act  of 2002, 
available  at  www.fda.gov/oc/bioterrorism/bioact.html. 

16.  Federal  Register,  vol.  69,  no.  236  (December  9,  2004),  p.  71561. 
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Internalizing  the  Costs 
of  Food  and  Agriculture  Security 

Specific  options  that  could  cause  the  food  and  agriculture 
industry  to  internalize  more  of  the  costs  of  increasing 
their  security  efforts  are: 

■  Establishing  more-extensive  labeling  and  tracking  sys¬ 
tems  for  food  products.  Such  systems  also  could  in¬ 
clude  the  tracking  of  animals  and  animal  products, 
with  the  goal  of  helping  health  officials  more  quickly 
pinpoint  and  isolate  the  source  of  contamination. 
Other  requirements  could  include  regular  sampling  at 
different  stages  of  food  processing  and  delivery  to  de¬ 
tect  a  wider  range  of  dangerous  contaminants.^^ 

■  Short  of  complete  labeling,  indicating  the  country  or 
region  of  origin  for  some  foods — if  that  could  help 
health  officials  more  quickly  pinpoint  the  sources  of 
contamination.  (Otherwise,  reports  of  contamination 
might  lead  to  discarding  more  food  than  was  neces¬ 
sary.) 

■  Establishing  full  tracking  of  ownership  for  the  most 
hazardous  materials  in  the  agriculture  industry  that 
could  be  used  as  weapons  (including  nitrates  and  cer¬ 
tain  pesticides). 

■  Establishing  enhanced  incentives  and  protections  for 
reporting  new  incidents  of  food  contamination,  im¬ 
proper  sales  of  hazardous  materials,  unsafe  processing 
and  handling  procedures,  or  incomplete  inspections 
that  might  increase  consumers’  vulnerability. 

Socializing  the  Costs 

of  Food  and  Agriculture  Security 

In  some  cases,  government  efforts  to  conduct  or  fund 
safety  programs  may  be  more  cost-effective  than  private 


17.  Congressional  Research  Service,  Animal  Identification  and  Meat 
Traceability,  CRS  Report  for  Congress  RL32012  (updated  July  2, 
2004),  and  Country-of-Origin  Labeling fior  Food,  CRS  Report  for 
Congress  97-508  ENR  (updated  August  3,  2004). 


efforts.  For  example,  it  may  be  worth  considering  ex¬ 
panding  the  food  and  agricultural  inspection  system  by 
adding  inspectors  and  increasing  the  frequency  of  sam¬ 
pling  where  there  already  is  a  federal  role,  as  well  as  intro¬ 
ducing  federal  inspectors  in  other  vulnerable  markets. 

Improving  Information 

Suppliers  may  have  little  information  about  the  technolo¬ 
gies  for  or  costs  of  making  their  products  safer.  Further, 
they  may  not  know  about  threats  to  safety  that  are  intro¬ 
duced  somewhere  farther  along  in  the  supply  chain.  That 
last  point  is  especially  relevant  for  individual  food  busi¬ 
nesses  that  do  not  have  full  control  over  their  production, 
distribution,  and  retail  activities — because  they  lack  ei¬ 
ther  direct  ownership  of  that  full  chain  of  activities  or 
long-standing  arrangements  with  their  suppliers  and  cus¬ 
tomers. 

Expanding  programs  to  provide  early  warning  of  contam¬ 
inations — without  creating  a  major  new  regulatory  sys¬ 
tem — could  help  improve  information.  One  such  option 
would  be  the  creation  of  new  public/private  partnerships 
to  help  quickly  disseminate  information  on  specific 
threats  to  the  general  public — for  example,  on  assaults  in 
progress — or  on  general  threats  and  potential  corrective 
actions.  Those  partnerships  could  help  move  critical  in¬ 
formation  to  individuals,  businesses,  and  local  govern¬ 
ments  that  must  take  action.  A  related  option  would  be 
to  create  new  information  clearinghouses  to  address  the 
difficulty  of  pulling  together  isolated  pieces  of  informa¬ 
tion  on  outbreaks  of  certain  illnesses  or  instances  of  con¬ 
tamination  that  are  not  widely  monitored — in  much  the 
same  way  that  certain  communicable  diseases  must  now 
be  reported  to  the  Centers  for  Disease  Control  and  Pre¬ 
vention.  That  option  could  help  move  information  up¬ 
ward  toward  central  agencies  that  could  look  for  broad 
patterns  and  provide  early  warning  of  an  assault  under 
way. 


